One card per question you missed, the ones you were sure about first. Cover the answer, say it out loud, then check. Look at each card again on the days listed: 1, 3, 7 and 21 days from Oct 25. If you miss it again, start that card over.
Vulnerability Managementmarked sure
An OpenVAS scan at a law firm flags CVE-2021-41773 (Apache path traversal) on a Debian web server because the banner reports Apache/2.4.49. The sysadmin replies that Debian backports security fixes without changing the version string, and dpkg shows apache2 2.4.49-4+deb11u1. The analyst must decide how to record the finding. What is the correct classification and next step?
Answer: D. Probable false positive; check the changelog for the CVE fix, test the traversal request, then document the result before closing
Banner-based detection reports the upstream version string, and distributions that backport fixes keep the original string while patching the code. NIST SP 800-40 Rev. 4 treats verification of what is actually installed as part of patch management, and a finding is closed as a false positive only after validation.
Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
Reporting and Communicationmarked sure
A SOC lead at a bank wants to share indicators from an active intrusion with a peer bank's security team so they can check for the same actor. The incident is not public, and the bank's legal team says details must stay inside the peer bank itself, with nothing passed to its customers, clients or parent company. Which Traffic Light Protocol marking should the report carry?
Answer: D. TLP:AMBER+STRICT, which limits disclosure to the recipient's own organisation and excludes clients
FIRST's TLP 2.0 defines four labels. TLP:AMBER permits the recipient to share within their organisation and with its clients on a need-to-know basis.
Source: FIRST Traffic Light Protocol (TLP) 2.0
Security Operationsmarked sure
After a contractor's VPN credentials were phished, an attacker at a bank reached a payroll database from the VPN address pool even though the contractor only needed a ticketing portal. The CISO asks the security architect for the design change that would have stopped this. Which recommendation reflects zero trust architecture as NIST SP 800-207 defines it?
Answer: A. Put a policy enforcement point in front of each application and authorise every request per session by identity and device posture, regardless of network location
NIST SP 800-207 defines zero trust around the principle that being on a network segment grants no implicit access; each resource request is evaluated by a policy decision point and enforced by a policy enforcement point using subject identity, device state, and other signals.
Source: NIST SP 800-207, Zero Trust Architecture
Vulnerability Management
A DevOps engineer at a SaaS startup reviews application logs for a feature that fetches a preview image from any URL a user supplies. One log line shows a request to http://169.254.169.254/latest/meta-data/iam/security-credentials/ returning HTTP 200 with a 1.2 KB body. The request originated from the application server itself. What vulnerability class is this, and what is the right fix?
Answer: A. Server-side request forgery (CWE-918); validate the destination against an allow list of hosts, block link-local and private ranges, and require IMDSv2 tokens on the cloud instances
The server made an outbound request to an attacker-chosen address, and that address was the cloud metadata endpoint, which hands out temporary IAM credentials. That is server-side request forgery as CWE-918 defines it.
Source: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerability Management
A penetration tester at an MSP scans a client's DMZ host with nmap -sS -p 22,80,443,8443 203.0.113.40. The output reads: 22/tcp filtered ssh, 80/tcp open http, 443/tcp open https, 8443/tcp closed https-alt. The client asks whether SSH is reachable from the internet. What is the accurate answer, and what distinguishes it from port 8443?
Answer: B. Port 22 is undetermined because no reply or an ICMP unreachable came back, pointing to a firewall; 8443 is closed because the host sent a RST
Nmap's port-scanning documentation defines the states precisely. Open means an application accepted the SYN. Closed means the port is accessible but the host sent a RST, so no listener is present.
Source: Nmap Reference Guide, Port Scanning Basics
Reporting and Communication
A SOC manager at an MSP presents quarterly metrics to a client's board. One slide shows: phishing incident opened 09:10, malicious email delivered 06:42, credential reset and mailbox rules removed 11:55. The board asks which of these numbers reflects how quickly the team notices attacks versus how quickly it stops them. What are the correct metrics and values?
Answer: A. MTTD is delivery to detection, 2 hours 28 minutes; MTTR is detection to containment, 2 hours 45 minutes
NIST SP 800-61 Rev. 2 recommends tracking incident data such as the time from an incident's start to its discovery and the time from discovery to each response step, and CySA+ frames those as MTTD and MTTR.
Source: NIST SP 800-61 Rev. 2, Section 3.4.2 Using Collected Incident Data
Reporting and Communication
A public US-listed company discovers a material cybersecurity incident on a Tuesday. Per SEC Item 1.05 of Form 8-K (effective December 2023), what is the disclosure deadline?
Answer: B. Within four business days of determining the incident is material
SEC Item 1.05 of Form 8-K (released July 2023, effective December 2023) requires disclosure within four business days of the determination that an incident is material. The trigger is materiality determination, not incident discovery.
Source: SEC Cybersecurity Disclosure Rules
Reporting and Communication
At 14:20 a SOC analyst at a logistics firm confirms that ransomware has encrypted the warehouse management system and a ransom note names the company. The CEO is travelling, a journalist has already emailed the press office, and a customer is asking why shipments stopped. The incident response plan lists escalation contacts. Who should the analyst notify first, and how?
Answer: C. Declare the incident via the escalation path and brief the incident commander, who involves executives and legal so designated owners issue external communications
NIST SP 800-61 Rev. 2 states that incident notification should follow the procedures in the response plan, with the incident handling team informing management and the parties the plan designates, and it warns against ad hoc external communication.
Source: NIST SP 800-61 Rev. 2, Section 3.2.7 Incident Notification
Review on: Oct 26, Oct 28, Nov 1, Nov 15.