Cybersecurity Manager

Sample question 1

Cardinal Manufacturing's cybersecurity manager is building next year's cybersecurity budget under a hard cap from finance at last year's total dollar amount. Three things are competing for that same fixed pool of money: two open analyst positions on the security operations team that have been vacant for six months and are currently covered by expensive contractor overtime, a managed detection and response contract up for renewal at a 15 percent higher rate with no change in service, and a new email security platform whose vendor claims it would meaningfully cut phishing-driven incidents. The manager cannot fund all three at the levels requested. Which approach best reflects sound management of the cybersecurity budget, staffing, and contracting for the coming year?

1. A.Weigh the risk each item currently leaves unaddressed, the analyst vacancies, the managed detection coverage, and the phishing exposure, against what each dollar buys, then commit the fixed budget to whichever combination closes the most risk, negotiating or deferring the rest.
2. B.Renew the managed detection and response contract at the vendor's new rate without attempting to negotiate the price, since any lapse in outsourced detection coverage would leave the network unmonitored, and cover the analyst vacancies and the new email platform out of next year's budget instead.
3. C.Fill both vacant analyst positions before anything else, since an unfilled seat on the security team is the most visible gap to the board, and push the managed detection renewal and the email platform purchase into the following budget cycle.
4. D.Approve the new email security platform first, since phishing is consistently the leading way attackers gain initial access, and let the managed detection contract lapse for a few months while the analyst vacancies stay open.

Sample question 2

Your organization has scheduled an external red team engagement to run for two weeks starting Monday. Independently, your SOC has planned a threat hunting sprint focused on the same segment of the network during the same window, and a separate business unit has scheduled a large scale vulnerability scan of internet facing assets for Wednesday. Applying cyber operations principles and practices, what should you do before Monday?

1. A.Coordinate all three activities: put each one on a shared calendar with its scope and timing, and give the SOC a fast way to check whether an alert traces to a sanctioned activity before treating it as a real intrusion.
2. B.Ask the business unit to move its vulnerability scan to the following week and ask the SOC to shift its threat hunting sprint to a different segment, so the red team keeps that part of the network to itself during the two week engagement.
3. C.Confirm that each team has its own written authorization on file, then let the red team, the SOC, and the business unit proceed independently, checking in with their own leads if a question comes up during the two week window.
4. D.Reduce the SOC's alerting thresholds on the affected network segment for the duration of the red team engagement, so routine analysts are not repeatedly interrupted by activity that the red team or the vulnerability scan is likely causing during the window.

Sample question 3

Your SOC detects a domain admin account authenticating from an unfamiliar external IP address and creating new administrator accounts across several servers overnight. It is 2 a.m. Thursday. The on-call analyst wants to disable the account and force a password reset for every domain admin right now, before your team has mapped which other systems the intruder reached. Applying standard incident response principles and practices, what should you direct the team to do first?

1. A.Disable the compromised account and reset every domain admin credential across the organization immediately tonight, since removing the intruder's foothold matters more right now than finishing a complete map of every system the intrusion has touched.
2. B.Capture full forensic disk and memory images from every server the intruder may have reached before changing anything, so that the evidence stays admissible and the chain of custody holds, and defer any containment until that imaging is fully finished.
3. C.Contain quietly at the network layer, such as isolating the affected hosts and expanding monitoring, while a small team maps the extent of lateral movement and persistence, then carry out one coordinated eradication once the scope is understood.
4. D.Power off every server the intruder may have reached right away to cut off further access, and once those systems are fully offline and can no longer be reached, begin mapping how far the intrusion actually spread.