I85PREP
⌘ K
TR-C study materials
TR-C study resources

TR-C: TR-C Domain 5: Monitoring, Maintenance, and Troubleshooting

TR-C · Work through your exam, one topic at a time.

All guide sections

TR-C Domain 5: Monitoring, Maintenance, and Troubleshooting

TR-C Domain 5, Monitoring, Maintenance, and Troubleshooting, tests whether you can detect control failure, maintain the system, and diagnose faults without weakening security. Expect questions on continuous monitoring, KRIs and KPIs, log retention, alert thresholds, control testing, exception management, patching, maintenance windows, root-cause analysis, and troubleshooting method.

Core rules

  • Monitor both system health and control effectiveness. A server being up does not prove access reviews happened or backups restore.
  • Define thresholds and response actions before alerts fire. Route alerts to an owner and record triage, containment, and closure.
  • Test controls on a schedule and after significant change. Use samples, reperformance, or configuration checks, and retain results.
  • Manage exceptions explicitly: describe the gap, compensating control, owner, expiry, and remediation plan. An exception is not a permanent waiver.
  • Troubleshoot in order: confirm scope, reproduce, isolate the layer, check recent changes, verify the fix, and update monitoring or the runbook.

Worked example

A nightly backup alert reports repeated failures for one database. The operator confirms scope, checks the job log, and finds the storage target is full because retention was misconfigured during a change. The team expands storage, corrects retention, reruns the backup, and performs a restore test to a non-production environment. A problem record identifies the missing retention check in the change template. Monitoring adds a storage-capacity threshold and a restore-test reminder. Closure evidence includes the alert, logs, change record, restore result, and updated monitor.

Traps

Do not monitor only infrastructure and call it control monitoring. Do not ignore alert fatigue or leave alerts without owners. Do not close a troubleshooting ticket after service restoration without root-cause analysis. Do not patch or change during maintenance without a rollback and validation step. Do not let exceptions expire silently or lose the original test evidence.