HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: ISACA CSX-P — Cybersecurity Practitioner
Provider: ISACA
Exam code: CSX-P (certification identifier; confirm current availability and naming with ISACA)
Exam format / duration: Confirm current format and duration with ISACA; offerings may change
Official question count: Not verified here; check the current official exam guide
Passing score: Not verified here; check the current official exam guide
Exam fee (USD): Not verified here; confirm current registration and eligibility fees with ISACA

Course Questions

10 Questions

During a security operations shift, consider: A workstation shows signs of malware infection. What should the responder do first?

A. Follow the incident response playbook, contain the affected system as appropriate, and notify the responsible security team. B. Ignore the alert unless a user confirms a visible outage. C. Delete logs and evidence to restore the system faster. D. Disable security controls broadly without authorization or impact assessment.

During a security operations shift, consider: An analyst sees repeated failed logins followed by a successful login from an unusual location. What should be done?

A. Disable security controls broadly without authorization or impact assessment. B. Investigate the event using authentication logs, user verification, and relevant endpoint or network evidence. C. Ignore the alert unless a user confirms a visible outage. D. Ignore the alert unless a user confirms a visible outage.

During a security operations shift, consider: A critical server is exposed to a known vulnerability. What is the best action?

A. Delete logs and evidence to restore the system faster. B. Disable security controls broadly without authorization or impact assessment. C. Assess severity and exposure, prioritize remediation, and apply a tested patch or approved mitigation D. Ignore the alert unless a user confirms a visible outage.

During a security operations shift, consider: A user reports a suspicious attachment but has not opened it. What should the responder recommend?

A. Ignore the alert unless a user confirms a visible outage. B. Delete logs and evidence to restore the system faster. C. Disable security controls broadly without authorization or impact assessment. D. Do not open it; report or submit it through the approved security process for analysis.

During a security operations shift, consider: A security alert has a high severity score but little supporting context. What is the next step?

A. Validate the alert by correlating telemetry and assessing asset criticality, exposure, and likely impact. B. Ignore the alert unless a user confirms a visible outage. C. Delete logs and evidence to restore the system faster. D. Delete logs and evidence to restore the system faster.

During a security operations shift, consider: An endpoint is suspected of being compromised. Why might isolation be appropriate?

A. Disable security controls broadly without authorization or impact assessment. B. To limit lateral movement and command-and-control activity while responders investigate. C. Ignore the alert unless a user confirms a visible outage. D. Delete logs and evidence to restore the system faster.

During a security operations shift, consider: An organization has no current asset inventory. What should security operations prioritize?

A. Delete logs and evidence to restore the system faster. B. Disable security controls broadly without authorization or impact assessment. C. Build and maintain an inventory of assets, owners, criticality, and exposure. D. Ignore the alert unless a user confirms a visible outage.

During a security operations shift, consider: A security analyst needs to investigate a suspicious event. What makes logs useful?

A. Delete logs and evidence to restore the system faster. B. Disable security controls broadly without authorization or impact assessment. C. Accurate timestamps, centralized collection, adequate retention, access protection, and correlation across systems. D. Ignore the alert unless a user confirms a visible outage.

During a security operations shift, consider: A phishing email appears to come from a trusted executive. What is the safest validation method?

A. Ignore the alert unless a user confirms a visible outage. B. Delete logs and evidence to restore the system faster. C. Disable security controls broadly without authorization or impact assessment. D. Verify the request through a separate trusted channel and report the suspected phishing attempt.

During a security operations shift, consider: A firewall rule permits broad inbound access that is no longer needed. What should happen?

A. Validate business need and remove or narrow the rule through approved change control. B. Ignore the alert unless a user confirms a visible outage. C. Delete logs and evidence to restore the system faster. D. Disable security controls broadly without authorization or impact assessment.

₹4999.00 ₹1999.00

Enroll Now

CSX-P