41. A fallback that makes things worse
When the product service times out, the fallback queries the same product database directly. During a database slowdown, the fallback makes the outage worse. Why?
- A.The fallback shares the failing dependency and adds load
- B.Fallbacks should always call a third-party API
- C.The timeout for the main path was too long
- D.The database cannot accept two types of queries
Show answer
Answer: A. The fallback shares the failing dependency and adds load
A fallback should not depend on the thing that is failing. Here every timeout sends another query to the same struggling database. Good fallbacks use independent sources: a local cache, static defaults or a degraded response. Test fallbacks under the same failure they are meant to handle.
42. Accepting orders while the DB is down
To keep taking orders during database outages, a team writes orders to a durable queue and inserts them later. What must they handle?
- A.Duplicates, ordering and showing users a pending state
- B.Nothing, since the queue makes writes exactly-once
- C.Only the size of the queue messages
- D.Re-running the outage to test the queue
Show answer
Answer: A. Duplicates, ordering and showing users a pending state
Store-and-forward keeps writes flowing, but replay can produce duplicates (needing idempotent inserts), records can apply out of order, and users must see "order received, confirming" since checks like stock cannot run yet. Conflicts found on replay need a plan, such as cancelling and notifying.
43. Telemetry backlog on a slow link
A device sends telemetry over a flaky link. During a long outage, its in-memory buffer grows until the device runs out of RAM and reboots. Which policy fits telemetry?
- A.An unbounded buffer moved to a bigger memory chip
- B.A bounded buffer that drops or samples oldest data first
- C.Blocking the sensor loop until the link returns
- D.Sending every reading twice when the link returns
Show answer
Answer: B. A bounded buffer that drops or samples oldest data first
Any buffer must be bounded, and you must choose what happens when it fills. For telemetry, recent data is usually most useful, so dropping the oldest, downsampling or summarising keeps memory flat. Blocking the sensor loop would stop the device doing its main job.
44. Logging bill tripled
The observability bill tripled after several services turned on debug logging and verbose health-check logs. Which plan cuts cost while keeping what you need for incidents?
- A.Turn off all application logging and rely only on metrics and traces for every future incident.
- B.Keep every log line, but compress the files with gzip on each node before they are shipped.
- C.Move all logs to the premium hot tier so queries run faster and engineers can fix issues sooner.
- D.Drop or sample noisy logs at the collector, set per-environment levels, and tier old logs to cheap storage.
Show answer
Answer: D. Drop or sample noisy logs at the collector, set per-environment levels, and tier old logs to cheap storage.
Most log spend is low-value volume. Filtering at the OpenTelemetry Collector or Fluent Bit stops it before ingestion charges apply, and per-environment levels keep debug out of production by default. Tiered retention keeps recent logs fast and older ones cheap for audits. Removing logs entirely hurts incident response.
45. Aurora Global Database in a regional outage
An Aurora Global Database has its primary in Mumbai and a secondary in Singapore. Mumbai becomes unavailable. What should the team expect when failing over?
- A.About a second of recent writes may be lost
- B.Zero data loss in all cases
- C.Hours of restore from snapshots
- D.Writes continue in both regions at once
Show answer
Answer: A. About a second of recent writes may be lost
Aurora Global Database replicates storage-level changes asynchronously, with lag usually under one second, so an unplanned failover can lose that much. The secondary cluster is promoted to take writes, usually within minutes. A managed switchover for planned moves waits for sync, so it avoids loss.
46. Evicting a Golden Ticket attacker
Investigators believe an attacker stole the krbtgt account hash and is forging Kerberos TGTs (Golden Tickets). Which remediation step is required to invalidate those tickets?
- A.Reset the passwords of all Domain Admin accounts once
- B.Reset the krbtgt password twice, allowing replication between resets, after removing the attacker's access
- C.Reboot every domain controller
- D.Disable Kerberos and use only NTLM
Show answer
Answer: B. Reset the krbtgt password twice, allowing replication between resets, after removing the attacker's access
Golden Tickets are signed with the krbtgt key, so only changing that key makes them invalid. Active Directory keeps the current and previous krbtgt password, so it must be reset twice, with time for replication in between to avoid breaking legitimate tickets. Do this only after closing the attacker's access paths, or they can steal the new hash.
47. An LSASS dump with a built-in DLL
You see this command run as SYSTEM on a server. What is the attacker doing and what follows for response?
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 692 C:\Users\Public\d.bin full
- A.Repairing a broken COM+ service, so no further action is needed
- B.Dumping LSASS to steal credentials, so reset accounts used there
- C.Installing a printer driver, so update the print server
- D.Compressing logs for backup, so check the backup schedule
Show answer
Answer: B. Dumping LSASS to steal credentials, so reset accounts used there
comsvcs.dll's MiniDump export can dump any process; PID 692 here is likely lsass.exe. The dump holds credentials of users who logged on to the host, so every privileged account that used it must be treated as compromised. Credential Guard and LSA protection (RunAsPPL) make this harder.
48. Suspected insider before confrontation
DLP shows a sales manager copying the customer list to a personal USB drive. HR wants to call them in today. What should the IR team insist on first?
- A.Quietly preserve evidence such as the laptop image, logs and email first
- B.Confront the employee by email so there is a written record
- C.Delete the customer list from all systems to prevent more copying
- D.Post a warning to all staff that someone is stealing data
Show answer
Answer: A. Quietly preserve evidence such as the laptop image, logs and email first
Once someone knows they are suspected, they may wipe devices or delete evidence. Collect logs, image the device and preserve mailboxes before any meeting, and work with HR and legal on monitoring rules and privacy law. Keep the circle of people who know very small.
49. Malware in a signed vendor update
A vendor reports its software update server was hacked and a signed update contained a backdoor. Your EDR saw nothing because the file was signed. What is the right response?
- A.Trust the hosts, because a valid signature proves the code is safe
- B.Treat every host that installed the update as possibly compromised and hunt for the IOCs
- C.Only uninstall the software from servers, as laptops cannot be affected
- D.Wait for the vendor to release the next update and do nothing until then
Show answer
Answer: B. Treat every host that installed the update as possibly compromised and hunt for the IOCs
In a supply chain attack the attacker's code is signed with the vendor's real key, so signatures do not help. Find every host with the bad version, look for the published IOCs and follow-on activity, and isolate or rebuild as needed, as with the SolarWinds case in 2020.
50. Ransomware on the hypervisor
All 40 VMs on a VMware ESXi cluster go down at once, and the datastore shows .vmdk files renamed with a new extension. No Windows EDR alerted. What most likely happened?
- A.Every VM got Windows ransomware at the same moment by chance
- B.A Linux/ESXi ransomware variant ran on the hosts and encrypted the VM disk files
- C.The storage array failed, which always renames files on reboot
- D.A VMware patch renamed the files as part of a normal upgrade
Show answer
Answer: B. A Linux/ESXi ransomware variant ran on the hosts and encrypted the VM disk files
Many gangs have ESXi encryptors that encrypt .vmdk files directly from the hypervisor, bypassing guest EDR entirely. Defences include keeping ESXi management off the user network, patching, MFA on vCenter, disabling SSH and immutable backups.
51. Forensics on a cloud VM
An Azure VM running a web app is compromised. You must collect evidence but the app team wants to delete the VM and redeploy now. What is the best order?
- A.Delete the VM first, then ask Microsoft for a copy of its disks
- B.Capture memory if possible, snapshot the disks, then isolate and redeploy clean
- C.Redeploy now and rely on the app logs, since VMs keep no evidence
- D.Run a full antivirus scan on the live VM and keep using it
Show answer
Answer: B. Capture memory if possible, snapshot the disks, then isolate and redeploy clean
Cloud makes evidence capture fast: grab memory if your tools allow, take disk snapshots, and restrict the network with an NSG. Once the VM and disks are deleted, the provider usually cannot recover them for you. Then a clean redeploy can go ahead.
52. Malware binary deleted while running
On a Linux server, ls -l /proc/4242/exe shows "/tmp/.x (deleted)". The file is gone from /tmp. How can you recover the binary for analysis?
- A.Copy /proc/4242/exe to a file while the process is still running
- B.It cannot be recovered once deleted, so kill the process now
- C.Reboot the server and look for the file again in /tmp
- D.Run "undelete /tmp/.x", which every Linux system includes
Show answer
Answer: A. Copy /proc/4242/exe to a file while the process is still running
A running process keeps its executable open, so the kernel still exposes it through /proc/<pid>/exe even after the file is unlinked. Copy it (and capture memory and /proc/<pid>/maps) before killing the process or rebooting, or the binary may be lost.
53. Logs about to roll over
The SIEM keeps logs for 30 days, and lawyers expect a lawsuit about a breach that began 25 days ago. What should the IR lead arrange immediately?
- A.Nothing, since 30 days is enough for any lawsuit
- B.Deleting the logs early so they cannot be used in court
- C.Asking the attacker to provide their own logs of the attack
- D.A legal hold that exports or preserves the relevant logs before they expire
Show answer
Answer: D. A legal hold that exports or preserves the relevant logs before they expire
Once litigation is reasonably expected, organisations usually have a duty to preserve relevant evidence. Automatic deletion of key logs could lead to sanctions and also loses evidence you need. Export the data to protected storage, and suspend relevant retention policies.
54. Testing the attacker's decryptor claim
After legal, sanctions and board review, a company decides it may pay a ransom. What do negotiators usually ask the gang for first?
- A.Decryption of a few sample files to prove they can restore data
- B.The real names of the gang members for the police report
- C.A promise in writing that they will never attack anyone again
- D.A refund policy if the company changes its mind later
Show answer
Answer: A. Decryption of a few sample files to prove they can restore data
Asking for test decryption of non-critical sample files checks that the gang actually has working keys for this victim. Even then, decryptors are often slow or buggy, so test them on copies. Payment also does not guarantee that stolen data is deleted.
55. The attacker sees your isolation
Logs show the attacker logged in to the EDR management console with a stolen admin account. What should change in the response plan?
- A.Regain control of the security tools first, then contain hosts
- B.Nothing, because attackers never look at security consoles
- C.Turn off the EDR completely, since it is now useless
- D.Continue isolating hosts from that same console as planned
Show answer
Answer: A. Regain control of the security tools first, then contain hosts
If the attacker controls the EDR or SIEM, they can see your moves, whitelist their tools or undo isolation. Regain control of security tooling first, using fresh credentials and MFA from a clean device, then carry out containment. Check the console audit log for what they changed.
56. Login from a new country, no MFA prompt
Logs show a user signed in from Bengaluru with MFA. Ten minutes later, the same session is used from a hosting IP abroad, with no new MFA prompt. What best explains this?
- A.The attacker guessed the user's password and MFA code
- B.A stolen session cookie or token is being replayed
- C.MFA was turned off for the user by the admin
- D.The user is using a VPN at home
Show answer
Answer: B. A stolen session cookie or token is being replayed
Adversary-in-the-middle kits and info-stealer malware capture session cookies after MFA succeeds. The attacker replays the cookie and is treated as already signed in. Detections look for the same session from impossible locations, and controls include token protection and compliant-device rules.
57. Purging a borderline email
A suspicious "Update your benefits" email reached 800 staff. HR is unsure whether its benefits vendor sent it. Analysis shows a lookalike domain registered 2 days ago. What should the analyst do?
- A.Leave it until HR confirms in a week
- B.Ask all 800 staff to find and delete it themselves
- C.Purge it, block indicators, then tell HR and staff
- D.Reply to the sender asking if it is real
Show answer
Answer: C. Purge it, block indicators, then tell HR and staff
A new lookalike domain imitating a vendor is strong evidence, and waiting gives attackers time. Removing an email is reversible, while a stolen login is not. Confirm with HR in parallel and send a short notice so staff know what happened.
58. Why the first report time matters
In a real phishing campaign the first user report arrived 4 minutes after delivery, but the SOC acted after 3 hours. What does this show?
- A.Speed of triaging reports is now the weak point
- B.User awareness training has failed completely and must be redone
- C.The email filter worked as designed
- D.The DMARC policy should be loosened
Show answer
Answer: A. Speed of triaging reports is now the weak point
Fast reports are only valuable if the SOC acts on them quickly. Most clicks happen in the first hour after a campaign lands, so a 3-hour triage delay throws away the early warning. Automating triage and purge of reported mail closes this gap.
59. Calculate an SLA credit
Your SLA promises 99.9% monthly uptime. Credits are 10% of the monthly fee if uptime is below 99.9% but at least 99.0%, and 25% if below 99.0%. In a 30-day month there was a single 3-hour outage. What credit is due?
- A.No credit, because 3 hours is within 99.9%
- B.10%, because uptime was about 99.58%
- C.25%, because uptime was below 99.0%
- D.50%, because it was a major outage
Show answer
Answer: B. 10%, because uptime was about 99.58%
A 30-day month has 43,200 minutes. 99.9% allows only about 43 minutes of downtime. With 180 minutes down, uptime = (43,200 - 180) / 43,200, about 99.58%, which falls in the 10% credit band. Applying credits proactively builds trust.
60. Question order effects
A survey asks about a recent outage first, then asks the NPS question. Why might this lower NPS?
- A.Earlier questions prime people to recall the bad event
- B.NPS must legally always be the very last question
- C.The outage question changes how the formula works
- D.Question order never has any effect on answers
Show answer
Answer: A. Earlier questions prime people to recall the bad event
Question order primes memories and feelings. Asking about an outage first makes it top of mind, which can drag down the general loyalty score. Put the main relational question first or keep order fixed over time.
