ISC2 CC Security Operations — Timed 20 Questions

Question 1

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

20 minute time limit — choose an answer to begin.

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 2

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic and blocks common network- and application-layer attacks such as SQL injection, cross-site scripting, and known exploit patterns before they reach the unpatched legacy system. Because the system cannot be patched, filtering malicious requests at the network edge is the most direct compensating control for exploitation via network-based attacks. It reduces exposure without modifying the vulnerable host.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 3

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

Accepted Answer

Escalate the alert to Tier 2 for further investigation.. Tier 1 analysts perform initial triage: validate the alert, gather basic context, and determine whether it warrants deeper investigation. A single failed login from an unusual geography is low-fidelity on its own and typically requires Tier 2 correlation with other telemetry (successful logins, MFA prompts, user confirmation) before action. Escalating to Tier 2 is the correct Tier 1 responsibility when the alert cannot be conclusively closed as benign at first glance.

Answer

Perform advanced forensic analysis on the affected system.

Answer

Conduct threat hunting to identify similar patterns.

Answer

Implement a firewall rule to block all traffic from that location.

Question 4

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Accepted Answer

Wait for the vendor to release a patch.. The patch lifecycle begins with identification and awareness — before any action can be taken, the organization must know a vulnerability exists and that a vendor patch is available or forthcoming. Waiting for the vendor to release a patch is the correct first step because without a patch, there is nothing to test, deploy, or compensate for; the organization can only monitor and prepare.

Answer

Apply compensating controls if the patch cannot be installed.

Answer

Deploy the patch immediately to all production servers.

Answer

Test the patch in a staging environment.

Question 5

A legacy system cannot be patched due to vendor unavailability. Which compensating control would be most effective in reducing the risk of exploitation?

Accepted Answer

Deploy a web application firewall (WAF) in front of the system.. A WAF is the most effective compensating control because it sits in front of the legacy system and can virtually patch the specific vulnerability by blocking malicious requests before they reach the unpatched application. Unlike logging or scanning, which are detective controls, a WAF is preventive and directly reduces the likelihood of exploitation. It is also more targeted than a generic IPS for web-based vulnerabilities, which are the most common attack vector for legacy systems.

Answer

Increase logging and monitoring of the system.

Answer

Perform weekly vulnerability scans on the system.

Answer

Apply a virtual patch using an intrusion prevention system (IPS).

Question 6

Which of the following is an indicator of a phishing email?

Accepted Answer

The email contains a sense of urgency and a suspicious link.. Phishing emails rely on social engineering to trick recipients into acting quickly without scrutiny. A sense of urgency ('your account will be closed in 24 hours') combined with a suspicious or mismatched link is a hallmark indicator, because attackers want the victim to click before verifying the sender or URL. Legitimate organizations rarely pressure users with immediate threats via email.

Answer

The email includes an attachment from a trusted source.

Answer

The email has a professional signature with contact details.

Answer

The email is from a known colleague.

Question 7

A critical vulnerability is discovered in a widely used VPN appliance that is actively being exploited in the wild. The vendor has released an emergency patch. However, the organization's patch management policy requires testing in a staging environment before production deployment. What should the security team do?

Accepted Answer

Deploy the patch immediately without testing to all devices. For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

Answer

Apply a workaround from the vendor and skip patching

Answer

Wait for the scheduled patch cycle to test thoroughly

Answer

Disconnect the VPN appliance until the next patch cycle

Question 8

A SOC analyst notices a large spike in outbound traffic from a workstation that is not scheduled for any data transfers. Upon checking the SIEM, the analyst sees that the workstation's antivirus was disabled 30 minutes ago. What type of logs should the analyst examine first to understand the sequence of events?

Accepted Answer

System logs. System logs in Windows (Event Log: System) record service state changes, including when the Windows Defender Antivirus service (WinDefend) or a third-party AV service is stopped, started, or fails. Since the antivirus was disabled 30 minutes before the traffic spike, the System log will contain the exact timestamp and event ID (e.g., Event ID 7036 for service state change, or 7040 for service start type change) that correlates with the beginning of the sequence. This makes System logs the primary source to reconstruct the timeline of the AV being turned off and subsequent suspicious activity.

Answer

Application logs

Answer

Firewall logs

Answer

Authentication logs

Question 9

Which type of log should be monitored to detect a user account that has been granted administrative privileges unexpectedly?

Accepted Answer

Authentication logs. Authentication logs record successful and failed logon events, including account name, time, source, and privilege changes associated with the logon. An unexpected grant of administrative privileges would appear as a change in the account's group membership or role recorded during authentication/authorization events, making authentication logs the primary source to detect it.

Answer

Application logs

Answer

System logs

Answer

Firewall logs

Question 10

A SOC team is reviewing security controls for a new critical application. Which THREE of the following are essential components of a security operations capability?

Accepted Answer

SIEM for log aggregation and alerting. SIEM, patch management, and configuration management are all core security operations functions. Backup management, while important, is not typically a SOC function.

Answer

Vulnerability scanning tools

Answer

Data backup and recovery procedures

Question 11

An organization is implementing a patch management policy. Which THREE steps are part of the standard patch lifecycle?

Accepted Answer

Deploying the patch to production systems. The standard patch lifecycle includes identifying vulnerabilities (often through vendor vulnerability disclosure, option D, which triggers the need for a patch), testing the patch in a staging environment (option E) to validate compatibility and functionality before broad rollout, and deploying the patch to production systems (option C) as the final remediation step. Option D is correct because vendor disclosure of a vulnerability is the initiating event that feeds the patch management process. Option E is correct because staging-environment testing is a required validation phase that prevents untested patches from breaking production. Option C is correct because production deployment is the actual application of the patch to remediate the vulnerability. Option A is not part of the standard lifecycle because emergency patching without testing bypasses the required testing phase and is only an exception for critical zero-day situations. Option B is not a defined lifecycle step; while backups are good practice, verifying backups before deployment is a general operational safeguard, not a standard patch lifecycle phase.

Answer

Emergency patching without testing

Answer

Verifying backups before deployment

Question 12

A small company's file server was encrypted by ransomware overnight, and no offline backups exist. The IT manager asks which security principle was most directly violated by relying only on a single, always-connected backup target.

Accepted Answer

Defense in depth. Layering independent protections means no single failure should be catastrophic. Because the primary data and its only backup were both online and reachable, one ransomware event destroyed both. An offline, immutable, or otherwise isolated copy would have survived the encryption and allowed restoration, which is the essence of defense in depth.

Answer

Separation of duties

Answer

Least privilege

Answer

Non-repudiation

Question 13

A security analyst is investigating a suspected insider threat. The employee has access to sensitive files and is suspected of copying data to a personal USB drive. Which Windows event log would BEST provide evidence of this activity?

Accepted Answer

Security log with event ID 6416 (A new external device was recognized by the system). Windows Security event ID 6416 is logged when a new external device is recognized, including USB drives. This event provides direct evidence of a USB device being connected, which is critical when investigating potential data exfiltration via removable media. Other event IDs either do not specifically track USB connections or are from the wrong log.

Answer

Security log with event ID 4663 (An attempt was made to access an object)

Answer

System log with event ID 20001 (Device installation)

Answer

Application log with event ID 1000 (Application error)

Question 14

A security administrator is configuring a Windows file server that stores payroll records. The requirement is that only members of the Payroll group can read the files, while members of the HR group must be able to modify them, and everyone else must be denied access. Which access control model best fits this requirement?

Accepted Answer

Role-Based Access Control (RBAC), because permissions are assigned to job roles and users receive access through their role membership.. The requirement maps directly to job functions: Payroll needs read access and HR needs modify access, with all others denied. RBAC expresses exactly that relationship by binding permissions to roles and users to roles, which enforces least privilege and keeps administration manageable. It also supports clean auditing because access can be reviewed by role. The other models either rely on owner discretion, system labels, or global rules that do not match the stated business need.

Answer

Discretionary Access Control (DAC), because each file owner decides who may access the file.

Answer

Rule-Based Access Control, because access is granted only during approved payroll processing windows.

Answer

Mandatory Access Control (MAC), because the operating system enforces labels that users cannot change.

Question 15

A security operations team is building a playbook for handling a suspected malware outbreak on a user's workstation. Which TWO actions should be performed during the containment phase? (Choose two.)

Accepted Answer

Disconnect the workstation from the network to stop further spread and command-and-control communication.. Containment limits the blast radius while preserving the ability to investigate. Disconnecting the host stops lateral movement and C2 traffic, and capturing volatile evidence preserves memory-resident artifacts that vanish on shutdown. Reimaging, mass notification, and indiscriminate file deletion all belong to later phases or violate evidence handling, so they do not belong in the containment step of the playbook.

Answer

Send a company-wide email naming the affected user and describing the suspected malware family.

Answer

Immediately reimage the workstation and return it to the user so business operations are not interrupted.

Answer

Delete all files created in the last 24 hours from the workstation to remove the malware.

Question 16

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring incoming alerts, performing initial triage, and deciding whether to escalate to Tier 2. They follow predefined playbooks to filter false positives and validate true positives. This role is explicitly designed for rapid alert assessment, not deep investigation or management.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 17

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

Accepted Answer

Authentication logs. Authentication logs record login attempts, successes, failures, source IP addresses, timestamps, and account names, making them the definitive source for investigating repeated failed logins followed by a successful login. Domain controllers log authentication events (e.g., Windows Security Event ID 4625 for failed logon and 4624 for successful logon) that directly capture this pattern. This is the primary evidence source for credential-based attacks like brute force or password spraying.

Answer

Application logs

Answer

Firewall logs

Answer

System logs

Question 18

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available

Question 19

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

Accepted Answer

Using write-once storage. Write-once storage (WORM—write once, read many) prevents any modification or deletion of log data after it is written, which directly addresses tampering by making alteration physically or logically impossible. This is the strongest control because it enforces immutability at the storage layer rather than relying on cryptographic or procedural safeguards that can be bypassed if keys or access are compromised.

Answer

Rotating logs daily

Answer

Encrypting logs with a symmetric key

Answer

Storing logs on the local system drive

Question 20

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. A link pointing to a domain that closely resembles—but is not exactly—the company's official domain is a classic phishing indicator (typosquatting or homoglyph attack). Attackers register lookalike domains to deceive users into entering credentials or downloading malware.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours