ISC2 CC Security Operations Practice Test 3 — 15 Questions

Question 1

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (WORM) physically prevents modification or deletion of log data after it is written, which is the strongest guarantee of log integrity. Because the media enforces immutability at the storage layer, even a compromised application or administrator cannot alter historical records.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key

Question 2

A critical zero-day vulnerability is actively being exploited in the wild, affecting an organization's internet-facing application. Which patching approach should be taken?

Accepted Answer

Deploy an emergency patch without testing.. When a zero-day vulnerability is actively exploited in the wild against an internet-facing application, the risk of waiting for full testing outweighs the risk of deploying an untested emergency patch. An emergency patch (or vendor hotfix) is deployed immediately with expedited change approval, because the active exploitation represents an imminent, ongoing threat that standard change-management timelines cannot accommodate.

Answer

Isolate the application from the network and wait for a vendor patch.

Answer

Implement a web application firewall (WAF) as a permanent solution.

Answer

Follow the standard patch lifecycle with testing.

Question 3

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker sends a fraudulent email, often impersonating a trusted entity like the IT department, to trick the recipient into revealing sensitive information such as passwords. The scenario describes an email from an unknown sender claiming to be from IT and requesting a password, which is a classic phishing attempt. The other options involve physical or direct access tactics.

Answer

Tailgating

Answer

USB drop attack

Answer

Piggybacking

Question 4

Which of the following is the most effective way to prevent tailgating in a secured facility?

Accepted Answer

Training employees to not hold doors open for unknown individuals.. Tailgating exploits social trust — an attacker follows an authorized person through a door. Training employees to challenge and not hold doors for unknown individuals directly addresses the human behavior that enables tailgating, making it the most effective preventive control. Technical controls alone cannot stop a person who is willingly allowed through.

Answer

Installing security cameras at all entrances.

Answer

Using keycard access for all doors.

Answer

Hiring security guards to monitor entrances.

Question 5

An organization wants to ensure that all workstations are configured according to a hardened baseline. Which process detects when a workstation deviates from this baseline?

Accepted Answer

Automated configuration scanning. Automated configuration scanning continuously compares each workstation's settings against a defined hardened baseline and flags deviations. It is the only option that provides ongoing detection of drift from the security configuration standard.

Answer

Patch management

Answer

Change control

Answer

Security awareness training

Question 6

A SOC analyst reviews a SIEM alert indicating a high volume of outbound traffic from a server to an external IP address known for command-and-control activity. The analyst has confirmed the alert is not a false positive. What is the most appropriate next step?

Accepted Answer

Conduct a deeper investigation to identify affected systems and data.. After confirming a SIEM alert is not a false positive, the most appropriate next step is to conduct a deeper investigation to identify affected systems and data. This aligns with the incident response process, where containment and eradication should be based on a thorough understanding of the scope and impact. Immediate blocking or rebooting without investigation could destroy evidence or disrupt business operations.

Answer

Escalate the alert to Tier 3 for advanced analysis.

Answer

Block the external IP address at the firewall immediately.

Answer

Reboot the server to terminate any malicious processes.

Question 7

A security analyst is reviewing firewall logs and notices an unusually high number of blocked outbound connections to a single external IP address. Which TWO actions should the analyst take to investigate this potential security incident? (Choose two.)

Accepted Answer

Check threat intelligence feeds for the external IP address.. Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.

Answer

Increase logging for all traffic to that IP.

Answer

Disable the firewall rule that is blocking the connections.

Answer

Block all outbound traffic from the source system.

Question 8

An organization is implementing a security baseline for new servers. Which THREE components are typically included in a hardened baseline configuration? (Choose three.)

Accepted Answer

Disabling unnecessary services and ports.. Option B is correct because a hardened baseline minimizes the attack surface by disabling unnecessary services and closing unused ports, reducing the number of exploitable entry points on a new server. Option D is correct because enforcing strong password policies (for example, minimum length, complexity, and expiration requirements) strengthens authentication and mitigates brute-force and credential-guessing attacks. Option E is correct because installing all available security patches ensures known vulnerabilities in the OS and applications are remediated before the server is placed into production. Option A does not belong because allowing RDP from any IP address exposes the server to unauthorized remote access and should instead be restricted to trusted management networks. Option C does not belong because automatic login for administrators bypasses authentication entirely, directly undermining the purpose of a security baseline.

Answer

Allowing remote desktop access from any IP address.

Answer

Enabling automatic login for administrators.

Question 9

A security awareness trainer is developing material on USB drop attacks. Which TWO messages should be included in the training? (Choose two.)

Accepted Answer

Never plug in a USB drive that you found lying around.. Option B is correct because the core defense against USB drop attacks (such as BadUSB or HID-spoofing devices that emulate keyboards) is simply never inserting an unknown drive into any system, since malicious firmware can execute before any OS-level controls apply. Option D is correct because reporting found drives to the security team allows them to be safely collected and analyzed as potential threat indicators, and it removes the drive from the environment so others are not tempted to plug it in. Options A, C, and E do not belong: using the drive on a non-networked computer still exposes that host to malicious firmware or autorun payloads, antivirus scanning cannot detect firmware-level or HID-emulation attacks and may itself trigger the payload, and formatting a drive does not neutralize malicious controller firmware and requires plugging it in first.

Answer

Use the USB drive only on a non-networked computer.

Answer

Always scan a found USB drive with antivirus before using.

Answer

Format the USB drive before using it.

Question 10

A security analyst at a Security Operations Centre (SOC) receives an alert from the SIEM indicating multiple failed login attempts for a user account followed by a successful login from an unusual geographic location. According to SOC tier responsibilities, which tier should perform the initial triage of this alert?

Accepted Answer

Tier 1 analyst. Tier 1 analysts are responsible for initial alert triage — monitoring the SIEM queue, validating alerts, gathering basic context, and escalating confirmed incidents to Tier 2. The scenario describes a standard alert requiring first-level review, which falls squarely within Tier 1 duties. Escalation to higher tiers occurs only after Tier 1 confirms the incident or determines it requires deeper investigation.

Answer

IT support team

Answer

Tier 2 analyst

Answer

Tier 3 analyst

Question 11

An organization must retain authentication logs for compliance with PCI DSS. What is the minimum retention period and the requirement for immediate availability?

Accepted Answer

12 months retention with 3 months immediately available. PCI DSS Requirement 10.7 mandates retaining audit logs for at least 12 months, with a minimum of the most recent 3 months immediately available for analysis. This ensures organizations can investigate recent incidents quickly while still preserving a full year of history for forensic and compliance review.

Answer

6 months retention with 1 month immediately available

Answer

24 months retention with 12 months immediately available

Answer

18 months retention with 6 months immediately available

Question 12

An employee receives an email that appears to be from the CEO requesting an urgent wire transfer to a new vendor. The email contains several grammatical errors and the sender's address is slightly misspelled. What type of security incident is this?

Accepted Answer

Phishing attack. The email impersonates the CEO, uses a spoofed/misspelled sender address, contains grammatical errors, and pressures the recipient into an urgent wire transfer — all classic hallmarks of a phishing attack, specifically a business email compromise (BEC) variant. Phishing is a social-engineering attack that uses fraudulent communications to trick users into revealing information or performing actions like transferring funds.

Answer

USB drop attack

Answer

Tailgating incident

Answer

Password attack

Question 13

To protect the integrity of log files, which of the following is a best practice?

Accepted Answer

Use write-once storage or a separate log server. Using write-once storage (WORM) or a separate log server protects log integrity by preventing modification or deletion of log files. Write-once storage ensures logs cannot be altered after being written, and a separate log server isolates logs from the source system, reducing the risk of tampering by compromised hosts.

Answer

Store logs on the same server as the application

Answer

Allow administrators to edit logs for accuracy

Answer

Encrypt logs but store them locally

Question 14

An organization implements a security baseline using CIS Benchmarks for all new servers. After a routine scan, a server is found to have a configuration that deviates from the baseline. The deviation was introduced by a system administrator to resolve a performance issue. What is the best course of action?

Accepted Answer

Document the change and submit it through the change control process. When a deviation from a security baseline is introduced for a legitimate operational reason, the proper governance response is to document the change and route it through the change control process. This preserves the integrity of the baseline while allowing a formally reviewed and approved exception, ensuring the deviation is tracked, justified, and periodically reassessed rather than silently accepted or blindly reverted.

Answer

Ignore the deviation since it was done for a valid reason

Answer

Revert the change immediately without discussion

Answer

Update the baseline to match the new configuration

Question 15

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate logs to generate alerts. A SIEM's core function is to aggregate log and event data from many sources, normalize it, and correlate events across systems to detect and alert on security incidents. Correlation is what distinguishes a SIEM from simple log collection — it identifies patterns spanning multiple events that individually look benign.

Answer

Encrypt sensitive data at rest

Answer

Manage user passwords and access controls

Answer

Block malicious network traffic in real time