CCNP Security 300-745 SDSI Practice Test 22

Correct Answer: A post-incident review (lessons learned analysis) that identifies the root cause, contributing design gaps, and specific control failures that allowed the incident to occur or worsen
Explanation: A structured post-incident review identifying root cause and contributing design gaps should inform design modification, unlike purchasing products without root-cause analysis, assuming no modification is needed once contained, relying only on informal discussion, assuming identical root causes across incidents, or permanently disabling affected systems instead of redesigning them.

Correct Answer: Redesigning network segmentation to more granularly restrict communication between the affected systems and other parts of the environment, based on the specific lateral movement path observed during the incident
Explanation: Redesigning segmentation based on the observed lateral movement path directly addresses the root cause, unlike increasing storage capacity, changing dashboard branding, extending password expiration, relocating systems physically with no logical segmentation change, or disabling logging.

Correct Answer: Testing the modified design (such as through a tabletop exercise, penetration test, or simulated replay of the incident's attack path) to confirm the specific gap identified during the post-incident review has actually been closed
Explanation: Testing the modified design against the specific identified gap (via tabletop exercise, pentest, or attack path replay) confirms actual remediation, unlike assuming any change is automatically effective, marking remediated with no testing, relying solely on verbal confirmation, skipping validation as unnecessary, or assuming recurrence is impossible regardless of actual effectiveness.

Correct Answer: Other systems sharing the same underlying design gap would remain vulnerable to a similar incident, since the modification was scoped narrowly to the specific system involved rather than addressing the broader pattern
Explanation: A narrowly scoped fix leaves other systems sharing the same underlying gap still vulnerable to a similar incident, unlike assuming narrow scoping automatically fixes every similar system, that DNS infrastructure fails, that it reduces costs with no coverage tradeoff, that it has no impact on future exposure, or that it automatically extends to unrelated systems.

Correct Answer: Whether the root cause represents a systemic design pattern likely present in other similar systems, versus an isolated, system-specific misconfiguration unlikely to recur elsewhere
Explanation: Whether the root cause is a systemic pattern versus an isolated misconfiguration most influences remediation scope, which is unrelated to the reporting dashboard's color scheme, SOC coffee brand, headquarters parking space count, an internal newsletter's font, or outdoor temperature.

Correct Answer: A structured post-incident review identifying root cause and design gaps, remediation scoped to address both the specific incident and any systemic pattern it represents, and validation testing confirming the identified gap has been closed
Explanation: A structured review, appropriately scoped remediation, and validation testing together provide an effective process, unlike purchasing products without root-cause analysis, scoping remediation to only the single system, skipping validation testing, relying only on informal discussion, or skipping modification once operations are restored.

Correct Answer: Review whether the original post-incident modification was scoped too narrowly to address only the first affected system, and assess whether the same underlying design gap exists at the newly affected system and potentially elsewhere in the environment
Explanation: Reviewing whether the original modification was too narrowly scoped and assessing whether the same gap exists elsewhere is the appropriate response, unlike blaming desktop wallpaper, concluding the entire practice is ineffective, wrongly assuming recurrence at a different system is a deprecated concern, blaming unrelated air conditioning, or blaming the phase of the moon.

Correct Answer: Containment and eradication focus on stopping the immediate incident and removing the active threat, while post-incident design modification focuses on addressing the underlying design gaps that allowed the incident to occur, to prevent recurrence
Explanation: Containment/eradication stop the immediate incident, while post-incident modification addresses underlying design gaps to prevent recurrence, unlike claiming the two are identical, that containment/eradication automatically fix design gaps, that this is guest-only, that modification must precede containment, or that immediate actions alone always prevent recurrence.

Correct Answer: Documenting post-incident findings in a centralized, searchable repository, tracking remediation action items to completion across all potentially affected systems, and periodically reviewing historical findings for patterns that indicate a need for broader architectural change
Explanation: Centralized documentation, tracked remediation to completion, and periodic pattern review together ensure lessons are systematically applied, unlike relying on informal team memory, documenting without tracking completion, one-time pattern review, limiting distribution to the original team, or discarding documentation after initial remediation.

Correct Answer: Applying an expedited but still structured change process (such as an emergency change process with mandatory peer review and rollback planning) rather than either delaying indefinitely or bypassing testing entirely
Explanation: An expedited but structured process with peer review and rollback planning balances urgency against rushed-change risk, unlike deploying with no review at all, delaying indefinitely and leaving the gap open, assuming post-incident changes carry no risk, skipping rollback planning, or requiring the same lengthy timeline as routine non-urgent changes.