ISC2 CC Security Operations Practice Test 2 — 15 Questions

Question 1

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

Accepted Answer

Escalate the alert to Tier 2 for further investigation.. Tier 1 analysts monitor alerts, triage them, and escalate potential incidents to higher tiers for deeper investigation.

Answer

Perform advanced forensic analysis on the affected system.

Answer

Conduct threat hunting to identify similar patterns.

Answer

Implement a firewall rule to block all traffic from that location.

Question 2

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 3

An organization needs to retain authentication logs for compliance with PCI DSS. What is the minimum retention period required, and how long must the logs be immediately available?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately accessible for analysis.

Answer

18 months retention, 6 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

24 months retention, 12 months immediately available

Question 4

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (e.g., WORM drives) ensures data cannot be modified, deleted, or overwritten, preserving integrity.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key

Question 5

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Accepted Answer

Wait for the vendor to release a patch.. The patch lifecycle begins with disclosure of the vulnerability, which prompts the vendor to develop and release a patch.

Answer

Apply compensating controls if the patch cannot be installed.

Answer

Deploy the patch immediately to all production servers.

Answer

Test the patch in a staging environment.

Question 6

A critical zero-day vulnerability is actively being exploited in the wild, affecting an organization's internet-facing application. Which patching approach should be taken?

Accepted Answer

Deploy an emergency patch without testing.. Emergency patching is used for vulnerabilities that are actively exploited or have high severity, bypassing normal testing cycles to reduce risk quickly.

Answer

Isolate the application from the network and wait for a vendor patch.

Answer

Implement a web application firewall (WAF) as a permanent solution.

Answer

Follow the standard patch lifecycle with testing.

Question 7

A legacy system cannot be patched due to vendor unavailability. Which compensating control would be most effective in reducing the risk of exploitation?

Accepted Answer

Deploy a web application firewall (WAF) in front of the system.. Network isolation prevents attackers from reaching the vulnerable system, while a WAF adds an additional layer of defense for web-based vulnerabilities.

Answer

Increase logging and monitoring of the system.

Answer

Perform weekly vulnerability scans on the system.

Answer

Apply a virtual patch using an intrusion prevention system (IPS).

Question 8

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate legitimate entities to trick victims into revealing sensitive information.

Answer

Tailgating

Answer

USB drop attack

Answer

Piggybacking

Question 9

Which of the following is the most effective way to prevent tailgating in a secured facility?

Accepted Answer

Training employees to not hold doors open for unknown individuals.. Tailgating occurs when an unauthorized person follows an authorized person through a door. Employee awareness training teaches staff not to hold doors open for strangers.

Answer

Installing security cameras at all entrances.

Answer

Using keycard access for all doors.

Answer

Hiring security guards to monitor entrances.

Question 10

An organization wants to ensure that all workstations are configured according to a hardened baseline. Which process detects when a workstation deviates from this baseline?

Accepted Answer

Automated configuration scanning. Configuration drift detection involves automated scanning that compares current configurations to the approved baseline and reports discrepancies.

Answer

Patch management

Answer

Change control

Answer

Security awareness training

Question 11

A SOC analyst reviews a SIEM alert indicating a high volume of outbound traffic from a server to an external IP address known for command-and-control activity. The analyst has confirmed the alert is not a false positive. What is the most appropriate next step?

Accepted Answer

Conduct a deeper investigation to identify affected systems and data.. Tier 2 analysts conduct deeper investigation to determine the scope and impact of a confirmed incident before initiating response actions.

Answer

Escalate the alert to Tier 3 for advanced analysis.

Answer

Block the external IP address at the firewall immediately.

Answer

Reboot the server to terminate any malicious processes.

Question 12

Which of the following is an indicator of a phishing email?

Accepted Answer

The email contains a sense of urgency and a suspicious link.. Phishing emails often create a sense of urgency to pressure recipients into acting without thinking, such as claiming an account will be closed.

Answer

The email includes an attachment from a trusted source.

Answer

The email has a professional signature with contact details.

Answer

The email is from a known colleague.

Question 13

A security analyst is reviewing firewall logs and notices an unusually high number of blocked outbound connections to a single external IP address. Which TWO actions should the analyst take to investigate this potential security incident? (Choose two.)

Accepted Answer

Check threat intelligence feeds for the external IP address.. Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.

Answer

Increase logging for all traffic to that IP.

Answer

Disable the firewall rule that is blocking the connections.

Answer

Block all outbound traffic from the source system.

Question 14

An organization is implementing a security baseline for new servers. Which THREE components are typically included in a hardened baseline configuration? (Choose three.)

Accepted Answer

Disabling unnecessary services and ports.. Hardened baselines include disabling unnecessary services to reduce attack surface, enforcing strong password policies, and applying security updates to fix known vulnerabilities.

Answer

Allowing remote desktop access from any IP address.

Answer

Enabling automatic login for administrators.

Question 15

A security awareness trainer is developing material on USB drop attacks. Which TWO messages should be included in the training? (Choose two.)

Accepted Answer

Never plug in a USB drive that you found lying around.. Users should not plug in unknown USB drives as they may contain malware, and they should report found drives to security for safe handling.

Answer

Use the USB drive only on a non-networked computer.

Answer

Always scan a found USB drive with antivirus before using.

Answer

Format the USB drive before using it.