ISC2 CC Security Operations Practice Test 3 — 15 Questions

Question 1

A security analyst at a Security Operations Centre (SOC) receives an alert from the SIEM indicating multiple failed login attempts for a user account followed by a successful login from an unusual geographic location. According to SOC tier responsibilities, which tier should perform the initial triage of this alert?

Accepted Answer

Tier 1 analyst. Tier 1 analysts are responsible for monitoring alerts and performing initial triage to determine if further investigation is needed.

Answer

IT support team

Answer

Tier 2 analyst

Answer

Tier 3 analyst

Question 2

An organization must retain authentication logs for compliance with PCI DSS. What is the minimum retention period and the requirement for immediate availability?

Accepted Answer

12 months retention with 3 months immediately available. PCI DSS requires a minimum of 12 months retention with at least 3 months immediately available for analysis.

Answer

6 months retention with 1 month immediately available

Answer

24 months retention with 12 months immediately available

Answer

18 months retention with 6 months immediately available

Question 3

A critical vulnerability is discovered in a widely used VPN appliance that is actively being exploited in the wild. The vendor has released an emergency patch. However, the organization's patch management policy requires testing in a staging environment before production deployment. What should the security team do?

Accepted Answer

Deploy the patch immediately without testing to all devices. For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

Answer

Apply a workaround from the vendor and skip patching

Answer

Wait for the scheduled patch cycle to test thoroughly

Answer

Disconnect the VPN appliance until the next patch cycle

Question 4

An employee receives an email that appears to be from the CEO requesting an urgent wire transfer to a new vendor. The email contains several grammatical errors and the sender's address is slightly misspelled. What type of security incident is this?

Accepted Answer

Phishing attack. This is a social engineering attack, specifically phishing (or CEO fraud), where the attacker impersonates a trusted figure to trick the employee.

Answer

USB drop attack

Answer

Tailgating incident

Answer

Password attack

Question 5

To protect the integrity of log files, which of the following is a best practice?

Accepted Answer

Use write-once storage or a separate log server. Using write-once storage (e.g., WORM) or a separate log server prevents tampering with log data.

Answer

Store logs on the same server as the application

Answer

Allow administrators to edit logs for accuracy

Answer

Encrypt logs but store them locally

Question 6

A SOC analyst notices a large spike in outbound traffic from a workstation that is not scheduled for any data transfers. Upon checking the SIEM, the analyst sees that the workstation's antivirus was disabled 30 minutes ago. What type of logs should the analyst examine first to understand the sequence of events?

Accepted Answer

System logs. System logs record service start/stop events, including antivirus disabling. Authentication logs may show who logged in, but system logs are more direct for service changes.

Answer

Application logs

Answer

Firewall logs

Answer

Authentication logs

Question 7

An organization implements a security baseline using CIS Benchmarks for all new servers. After a routine scan, a server is found to have a configuration that deviates from the baseline. The deviation was introduced by a system administrator to resolve a performance issue. What is the best course of action?

Accepted Answer

Document the change and submit it through the change control process. Any change to a security baseline should go through the change control process to ensure it is reviewed and approved, preventing unauthorized changes that could introduce vulnerabilities.

Answer

Ignore the deviation since it was done for a valid reason

Answer

Revert the change immediately without discussion

Answer

Update the baseline to match the new configuration

Question 8

Which type of log should be monitored to detect a user account that has been granted administrative privileges unexpectedly?

Accepted Answer

Authentication logs. Authentication logs typically record privilege escalation events, such as when a user is added to an admin group or granted elevated rights.

Answer

Application logs

Answer

System logs

Answer

Firewall logs

Question 9

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate logs to generate alerts. A SIEM aggregates and correlates logs from various sources, generates alerts, and stores historical data for analysis and forensics.

Answer

Encrypt sensitive data at rest

Answer

Manage user passwords and access controls

Answer

Block malicious network traffic in real time

Question 10

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system is critical for operations. Which compensating control is most appropriate to reduce the risk of exploitation?

Accepted Answer

Isolate the system on a separate network segment with strict access controls. Network isolation (segmentation) limits the system's exposure to potential attackers. A WAF can protect web-facing systems, but isolation is broader.

Answer

Increase logging and monitoring without any network changes

Answer

Apply a virtual patch using a web application firewall

Answer

Remove the system from the network entirely

Question 11

An organization is planning to implement a security awareness program. Which TWO topics should be included to address common social engineering attacks?

Accepted Answer

Recognizing phishing emails. Phishing awareness and tailgating awareness are both critical social engineering topics. USB drop attacks are also social engineering, but the question asks for TWO; phishing and tailgating are the most common.

Answer

Understanding encryption algorithms

Answer

Configuring firewall rules

Answer

Proper password management using a password manager

Question 12

A SOC team is reviewing security controls for a new critical application. Which THREE of the following are essential components of a security operations capability?

Accepted Answer

SIEM for log aggregation and alerting. SIEM, patch management, and configuration management are all core security operations functions. Backup management, while important, is not typically a SOC function.

Answer

Vulnerability scanning tools

Answer

Data backup and recovery procedures

Question 13

After a security incident, an investigator needs to analyze logs to determine the timeline of events. Which TWO types of logs are most likely to provide evidence of lateral movement within the network?

Accepted Answer

Authentication logs. Authentication logs show user logins to different systems (lateral movement), and firewall logs show connections between internal hosts. System logs may show service creation but are not as direct.

Answer

DNS logs

Answer

System logs

Answer

Application logs

Question 14

Which TWO of the following are common indicators of a phishing email?

Accepted Answer

Unexpected sender or email address. Unexpected sender and urgent language are classic phishing indicators. File attachments can be malicious, but presence alone is not always phishing; legitimate emails have attachments too. The other options are not typical phishing indicators.

Answer

Professional formatting with correct grammar

Answer

Presence of a file attachment

Answer

Use of the recipient's full name in the greeting

Question 15

An organization is implementing a patch management policy. Which THREE steps are part of the standard patch lifecycle?

Accepted Answer

Deploying the patch to production systems. The standard patch lifecycle includes vulnerability disclosure, testing in staging, and deployment to production. Emergency patching is a separate process, and verifying backup is not a standard step in patching.

Answer

Emergency patching without testing

Answer

Verifying backups before deployment