ISC2 CC Security Operations Practice Test 1 — 15 Questions

Question 1

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts monitor alerts and perform initial triage, escalating potential incidents to Tier 2 for deeper investigation.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 2

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.

Answer

Application logs

Answer

Firewall logs

Answer

System logs

Question 3

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available

Question 4

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

Accepted Answer

Using write-once storage. Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.

Answer

Rotating logs daily

Answer

Encrypting logs with a symmetric key

Answer

Storing logs on the local system drive

Question 5

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 6

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. Phishing emails often contain suspicious links that lead to malicious websites. Unexpected senders and urgency are also common indicators.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours

Question 7

What is the primary purpose of using security baselines derived from CIS Benchmarks?

Accepted Answer

To establish a secure starting point for system configuration. CIS Benchmarks provide hardened configuration standards to reduce vulnerabilities and improve security posture.

Answer

To ensure all systems have the same software versions

Answer

To monitor network traffic for anomalies

Answer

To automate patch deployment

Question 8

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

Accepted Answer

Tier 2. Tier 2 analysts conduct deeper investigation to confirm if the activity is malicious and determine the scope.

Answer

Tier 3

Answer

Tier 1

Answer

Incident Response Team

Question 9

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) can block malicious traffic targeting known vulnerabilities, providing a layer of defense for unpatched systems.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 10

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 11

An employee receives an email from the CEO asking for an urgent wire transfer to a new vendor. The email address is slightly misspelled. What type of attack is this?

Accepted Answer

Phishing. This is a social engineering attack, specifically phishing (or business email compromise), aiming to trick the employee into transferring money.

Answer

Shoulder surfing

Answer

USB drop attack

Answer

Tailgating

Question 12

A configuration management tool detects that a critical server's security settings have changed from the approved baseline. What is the first action the security team should take?

Accepted Answer

Investigate the root cause of the configuration change. The first step is to investigate the cause of the drift, as it may indicate a misconfiguration or compromise.

Answer

Isolate the server from the network

Answer

Automatically revert the settings to the baseline

Answer

Update the baseline to match the current configuration

Question 13

An organization is implementing a security awareness program. Which THREE topics should be included to address common social engineering attacks? (Select THREE)

Accepted Answer

Tailgating awareness. Phishing, tailgating, and USB drop attacks are common social engineering vectors. Password security, while important, is more about authentication hygiene.

Answer

Secure coding practices

Answer

Password complexity requirements

Question 14

A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)

Accepted Answer

Firewall logs. Firewall logs show allowed outbound connections, and proxy logs can reveal web traffic and file uploads, both critical for detecting exfiltration.

Answer

Patch management logs

Answer

System logs

Answer

Authentication logs

Question 15

A security engineer is designing a patch management process. Which TWO steps are part of the standard patch lifecycle? (Select TWO)

Accepted Answer

Testing the patch in a staging environment. The patch lifecycle includes testing in a staging environment and deploying to production after approval.

Answer

Vulnerability disclosure by researcher

Answer

Decommissioning the vulnerable system

Answer

Immediately deploying patches to all systems