ISC2 CC Security Operations — 10 Questions

Question 1

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts monitor alerts and perform initial triage, escalating potential incidents to Tier 2 for deeper investigation.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 2

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.

Answer

Application logs

Answer

Firewall logs

Answer

System logs

Question 3

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available

Question 4

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

Accepted Answer

Using write-once storage. Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.

Answer

Rotating logs daily

Answer

Encrypting logs with a symmetric key

Answer

Storing logs on the local system drive

Question 5

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 6

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. Phishing emails often contain suspicious links that lead to malicious websites. Unexpected senders and urgency are also common indicators.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours

Question 7

What is the primary purpose of using security baselines derived from CIS Benchmarks?

Accepted Answer

To establish a secure starting point for system configuration. CIS Benchmarks provide hardened configuration standards to reduce vulnerabilities and improve security posture.

Answer

To ensure all systems have the same software versions

Answer

To monitor network traffic for anomalies

Answer

To automate patch deployment

Question 8

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

Accepted Answer

Tier 2. Tier 2 analysts conduct deeper investigation to confirm if the activity is malicious and determine the scope.

Answer

Tier 3

Answer

Tier 1

Answer

Incident Response Team

Question 9

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) can block malicious traffic targeting known vulnerabilities, providing a layer of defense for unpatched systems.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 10

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems