ISC2 CC Security Operations — Timed 20 Questions

Question 1

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts monitor alerts and perform initial triage, escalating potential incidents to Tier 2 for deeper investigation.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 2

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.

Answer

Application logs

Answer

Firewall logs

Answer

System logs

Question 3

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available

Question 4

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

Accepted Answer

Using write-once storage. Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.

Answer

Rotating logs daily

Answer

Encrypting logs with a symmetric key

Answer

Storing logs on the local system drive

Question 5

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 6

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. Phishing emails often contain suspicious links that lead to malicious websites. Unexpected senders and urgency are also common indicators.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours

Question 7

What is the primary purpose of using security baselines derived from CIS Benchmarks?

Accepted Answer

To establish a secure starting point for system configuration. CIS Benchmarks provide hardened configuration standards to reduce vulnerabilities and improve security posture.

Answer

To ensure all systems have the same software versions

Answer

To monitor network traffic for anomalies

Answer

To automate patch deployment

Question 8

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

Accepted Answer

Tier 2. Tier 2 analysts conduct deeper investigation to confirm if the activity is malicious and determine the scope.

Answer

Tier 3

Answer

Tier 1

Answer

Incident Response Team

Question 9

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) can block malicious traffic targeting known vulnerabilities, providing a layer of defense for unpatched systems.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 10

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 11

An employee receives an email from the CEO asking for an urgent wire transfer to a new vendor. The email address is slightly misspelled. What type of attack is this?

Accepted Answer

Phishing. This is a social engineering attack, specifically phishing (or business email compromise), aiming to trick the employee into transferring money.

Answer

Shoulder surfing

Answer

USB drop attack

Answer

Tailgating

Question 12

A configuration management tool detects that a critical server's security settings have changed from the approved baseline. What is the first action the security team should take?

Accepted Answer

Investigate the root cause of the configuration change. The first step is to investigate the cause of the drift, as it may indicate a misconfiguration or compromise.

Answer

Isolate the server from the network

Answer

Automatically revert the settings to the baseline

Answer

Update the baseline to match the current configuration

Question 13

An organization is implementing a security awareness program. Which THREE topics should be included to address common social engineering attacks? (Select THREE)

Accepted Answer

Tailgating awareness. Phishing, tailgating, and USB drop attacks are common social engineering vectors. Password security, while important, is more about authentication hygiene.

Answer

Secure coding practices

Answer

Password complexity requirements

Question 14

A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)

Accepted Answer

Firewall logs. Firewall logs show allowed outbound connections, and proxy logs can reveal web traffic and file uploads, both critical for detecting exfiltration.

Answer

Patch management logs

Answer

System logs

Answer

Authentication logs

Question 15

A security engineer is designing a patch management process. Which TWO steps are part of the standard patch lifecycle? (Select TWO)

Accepted Answer

Testing the patch in a staging environment. The patch lifecycle includes testing in a staging environment and deploying to production after approval.

Answer

Vulnerability disclosure by researcher

Answer

Decommissioning the vulnerable system

Answer

Immediately deploying patches to all systems

Question 16

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

Accepted Answer

Escalate the alert to Tier 2 for further investigation.. Tier 1 analysts monitor alerts, triage them, and escalate potential incidents to higher tiers for deeper investigation.

Answer

Perform advanced forensic analysis on the affected system.

Answer

Conduct threat hunting to identify similar patterns.

Answer

Implement a firewall rule to block all traffic from that location.

Question 17

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 18

An organization needs to retain authentication logs for compliance with PCI DSS. What is the minimum retention period required, and how long must the logs be immediately available?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately accessible for analysis.

Answer

18 months retention, 6 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

24 months retention, 12 months immediately available

Question 19

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (e.g., WORM drives) ensures data cannot be modified, deleted, or overwritten, preserving integrity.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key

Question 20

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Accepted Answer

Wait for the vendor to release a patch.. The patch lifecycle begins with disclosure of the vulnerability, which prompts the vendor to develop and release a patch.

Answer

Apply compensating controls if the patch cannot be installed.

Answer

Deploy the patch immediately to all production servers.

Answer

Test the patch in a staging environment.