ISC2 CC Security Operations — Timed 10 Questions

Question 1

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

10 minute time limit — choose an answer to begin.

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 2

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic and blocks common network- and application-layer attacks such as SQL injection, cross-site scripting, and known exploit patterns before they reach the unpatched legacy system. Because the system cannot be patched, filtering malicious requests at the network edge is the most direct compensating control for exploitation via network-based attacks. It reduces exposure without modifying the vulnerable host.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 3

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

Accepted Answer

Escalate the alert to Tier 2 for further investigation.. Tier 1 analysts perform initial triage: validate the alert, gather basic context, and determine whether it warrants deeper investigation. A single failed login from an unusual geography is low-fidelity on its own and typically requires Tier 2 correlation with other telemetry (successful logins, MFA prompts, user confirmation) before action. Escalating to Tier 2 is the correct Tier 1 responsibility when the alert cannot be conclusively closed as benign at first glance.

Answer

Perform advanced forensic analysis on the affected system.

Answer

Conduct threat hunting to identify similar patterns.

Answer

Implement a firewall rule to block all traffic from that location.

Question 4

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Accepted Answer

Wait for the vendor to release a patch.. The patch lifecycle begins with identification and awareness — before any action can be taken, the organization must know a vulnerability exists and that a vendor patch is available or forthcoming. Waiting for the vendor to release a patch is the correct first step because without a patch, there is nothing to test, deploy, or compensate for; the organization can only monitor and prepare.

Answer

Apply compensating controls if the patch cannot be installed.

Answer

Deploy the patch immediately to all production servers.

Answer

Test the patch in a staging environment.

Question 5

A legacy system cannot be patched due to vendor unavailability. Which compensating control would be most effective in reducing the risk of exploitation?

Accepted Answer

Deploy a web application firewall (WAF) in front of the system.. A WAF is the most effective compensating control because it sits in front of the legacy system and can virtually patch the specific vulnerability by blocking malicious requests before they reach the unpatched application. Unlike logging or scanning, which are detective controls, a WAF is preventive and directly reduces the likelihood of exploitation. It is also more targeted than a generic IPS for web-based vulnerabilities, which are the most common attack vector for legacy systems.

Answer

Increase logging and monitoring of the system.

Answer

Perform weekly vulnerability scans on the system.

Answer

Apply a virtual patch using an intrusion prevention system (IPS).

Question 6

Which of the following is an indicator of a phishing email?

Accepted Answer

The email contains a sense of urgency and a suspicious link.. Phishing emails rely on social engineering to trick recipients into acting quickly without scrutiny. A sense of urgency ('your account will be closed in 24 hours') combined with a suspicious or mismatched link is a hallmark indicator, because attackers want the victim to click before verifying the sender or URL. Legitimate organizations rarely pressure users with immediate threats via email.

Answer

The email includes an attachment from a trusted source.

Answer

The email has a professional signature with contact details.

Answer

The email is from a known colleague.

Question 7

A critical vulnerability is discovered in a widely used VPN appliance that is actively being exploited in the wild. The vendor has released an emergency patch. However, the organization's patch management policy requires testing in a staging environment before production deployment. What should the security team do?

Accepted Answer

Deploy the patch immediately without testing to all devices. For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

Answer

Apply a workaround from the vendor and skip patching

Answer

Wait for the scheduled patch cycle to test thoroughly

Answer

Disconnect the VPN appliance until the next patch cycle

Question 8

A SOC analyst notices a large spike in outbound traffic from a workstation that is not scheduled for any data transfers. Upon checking the SIEM, the analyst sees that the workstation's antivirus was disabled 30 minutes ago. What type of logs should the analyst examine first to understand the sequence of events?

Accepted Answer

System logs. System logs in Windows (Event Log: System) record service state changes, including when the Windows Defender Antivirus service (WinDefend) or a third-party AV service is stopped, started, or fails. Since the antivirus was disabled 30 minutes before the traffic spike, the System log will contain the exact timestamp and event ID (e.g., Event ID 7036 for service state change, or 7040 for service start type change) that correlates with the beginning of the sequence. This makes System logs the primary source to reconstruct the timeline of the AV being turned off and subsequent suspicious activity.

Answer

Application logs

Answer

Firewall logs

Answer

Authentication logs

Question 9

Which type of log should be monitored to detect a user account that has been granted administrative privileges unexpectedly?

Accepted Answer

Authentication logs. Authentication logs record successful and failed logon events, including account name, time, source, and privilege changes associated with the logon. An unexpected grant of administrative privileges would appear as a change in the account's group membership or role recorded during authentication/authorization events, making authentication logs the primary source to detect it.

Answer

Application logs

Answer

System logs

Answer

Firewall logs

Question 10

A SOC team is reviewing security controls for a new critical application. Which THREE of the following are essential components of a security operations capability?

Accepted Answer

SIEM for log aggregation and alerting. SIEM, patch management, and configuration management are all core security operations functions. Backup management, while important, is not typically a SOC function.

Answer

Vulnerability scanning tools

Answer

Data backup and recovery procedures