The security engineering team is in the process of deploying a new PAM solution. How do they ensure the organization is aware of the implementation and is authorized to move forward?

• A. Update the risk register where PAM mitigates a finding.
• B. Get permission from the CISO.
• C. Submit to the change control board.
• D. Send an email to all the organization.

Kevin is a SOC analyst working with the SRE team to investigate a report of slow responses from a customer-facing web application. While looking at load balancer and WAF logs, Kevin has discovered that one of the web servers hosting the application has gone offline. He does not see any alerts in the WAF or from the endpoint detection and response agent running on the web server. As part of triaging this incident, what should they do next? (Choose all that apply.)

• A. Change the WAF from blocking mode to alert-only mode.
• B. Review recently scheduled requests in the company's change management system that may affect the same server.
• C. Review system logs collected from the server to identify who last logged into it.
• D. Provision a new server behind the load balancer to return the application to full service.

Which of the following would most directly help reduce false positives in a brute-force login detection?

• A. Lowering the detection threshold
• B. Increasing the search schedule frequency
• C. Adding context such as known VPN/proxy IP allowlists and account lockout status
• D. Removing the detection from production

Buttercup Games is under a multi-vector phishing attack. This attack is leveraging the trust in a popular machine learning development platform. Malicious emails impersonating the platform's employees are directing developers to compromised models that contain embedded malware.
How can Buttercup Games leverage automated threat detection and orchestrate a response strategy for alerts when users report phishing emails? (Choose all that apply.)

• A. Automatically update threat intelligence feeds if the alert results in a true positive.
• B. Automatically terminate user accounts on compromised machines.
• C. Automatically analyze artifacts and send the attachments and URLs to a sandbox to detonate malicious emails.
• D. Automatically block all IOCs at the network gateways on true positive alerts.

An architecture review reveals that sensitive HR data and SOC security logs are being stored in the same Splunk index, posing a risk of unauthorized access. What is the BEST approach to enforce strict least-privilege data access?

• A. Mask the HR data at search time using standard regular expressions so that SOC analysts cannot read it.
• B. Encrypt the HR data before it leaves the forwarder and refuse to give anyone the decryption key.
• C. Separate the HR data and SOC logs into different indexes and use Role-Based Access Control (RBAC) to restrict access to the HR index.
• D. Create a Splunk dashboard that only displays SOC data and instruct analysts to only use that dashboard.