CISSP Security Operations — 25 Questions

Question 1

During a security incident, an organization's SOC team identifies a series of unauthorized access attempts from an external IP address. The incident manager needs to escalate this to the appropriate team. According to the incident response plan, which role is primarily responsible for coordinating the response and communicating with stakeholders?

Accepted Answer

Incident manager. The incident manager leads the response, coordinates resources, and communicates with stakeholders.

Answer

Forensic investigator

Answer

Communications lead

Answer

SOC Tier 1 analyst

Question 2

An organization's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours for its critical financial application. Which disaster recovery site would be MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling the critical financial application to be operational within minutes to a few hours. With an RTO of 4 hours, a hot site provides the necessary infrastructure and up-to-date data to meet this stringent recovery timeline, as cold and warm sites require significant setup and data restoration time.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 3

A forensic investigator arrives at a crime scene involving a compromised server. The server is still running. According to the order of volatility, which of the following should the investigator capture FIRST?

Accepted Answer

CPU registers. CPU registers are the most volatile and must be captured first to preserve critical evidence.

Answer

RAM contents

Answer

Hard disk contents

Answer

Network connections

Question 4

Which of the following BEST describes the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures business functions continue, DRP restores IT operations. D is correct because the Business Continuity Plan (BCP) focuses on maintaining critical business functions during and after a disruption, ensuring minimal impact on operations, while the Disaster Recovery Plan (DRP) is a subset of BCP that specifically addresses the restoration of IT infrastructure, systems, and data after a disaster. The BCP encompasses broader organizational resilience, including manual workarounds and alternate sites, whereas the DRP targets technical recovery procedures such as system rebuilds, data restoration from backups, and failover to redundant systems.

Answer

BCP deals with natural disasters, DRP deals with cyberattacks

Answer

BCP is for IT systems, DRP is for business processes

Answer

BCP is a subset of DRP

Question 5

A SOC team is using a SIEM to correlate events from multiple sources. They want to automate responses to common threats. Which technology should they integrate to achieve security orchestration and automation?

Accepted Answer

SOAR. SOAR tools automate and orchestrate security responses, integrating with SIEM.

Answer

Vulnerability scanner

Answer

Endpoint detection and response (EDR)

Answer

Network-based IDS

Question 6

An organization's data loss prevention (DLP) solution is configured to block emails containing credit card numbers. This is an example of which type of DLP control?

Accepted Answer

Network DLP. Network DLP monitors and controls data in motion, such as email traffic.

Answer

Classification-based DLP

Answer

Cloud DLP

Answer

Endpoint DLP

Question 7

During a vulnerability management lifecycle, after vulnerabilities are identified and prioritized, what is the NEXT step?

Accepted Answer

Remediation. Remediation (patching or mitigating) follows prioritization.

Answer

Verification

Answer

Reporting

Answer

Risk acceptance

Question 8

Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?

Accepted Answer

RPO. RPO defines the acceptable data loss in terms of time.

Answer

MTTR

Answer

RTO

Answer

MTD

Question 9

An organization is implementing a change management process. Which group is responsible for reviewing and approving major changes?

Accepted Answer

Change Advisory Board (CAB). The Change Advisory Board (CAB) is the formal group within ITIL-based change management responsible for reviewing, assessing, and approving major or high-risk changes. Major changes typically require a CAB meeting to evaluate impact, resource requirements, and rollback plans before authorization. This ensures changes do not introduce security vulnerabilities or disrupt critical operations.

Answer

Project management office

Answer

Incident response team

Answer

Security operations center

Question 10

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. Chain of custody ensures evidence integrity through documentation of handling.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 11

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 12

An organization is recovering from a ransomware attack that encrypted critical servers. The backup strategy must ensure that the Recovery Point Objective (RPO) of 1 hour is met. Which backup method is MOST appropriate?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) captures changes in real time, meeting a 1-hour RPO.

Answer

Daily full backups

Answer

Weekly full backups with daily differentials

Answer

Snapshot every 4 hours

Question 13

A security analyst is examining a memory dump from a compromised workstation. Which TWO tools are commonly used for memory forensics?

Accepted Answer

Volatility. Volatility (C) is a leading open-source memory forensics framework that analyzes RAM dumps to extract running processes, network connections, and kernel objects. It supports multiple operating systems and profiles, making it essential for incident response and malware analysis.

Answer

Wireshark

Answer

EnCase

Answer

FTK Imager

Question 14

An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?

Accepted Answer

Roles and responsibilities. An IR plan should include roles, communication plan, and recovery procedures.

Answer

Vendor product list

Answer

Employee performance reviews

Question 15

A company is designing a disaster recovery strategy for its e-commerce platform. The platform requires an RTO of 2 hours and an RPO of 15 minutes. Which TWO strategies would BEST meet these requirements?

Accepted Answer

Cloud DR with continuous data replication. Hot site and cloud DR with continuous replication can meet aggressive RTO/RPO.

Answer

Tape backup restoration

Answer

Cold site

Answer

Warm site

Question 16

An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?

Accepted Answer

Incident categories. Incident categories define what events are considered incidents, enabling consistent classification and response.

Answer

Communication plan

Answer

Recovery procedures

Answer

Legal notification requirements

Question 17

During a digital forensics investigation, a security analyst must preserve evidence in order of volatility. Which of the following represents the correct sequence from most volatile to least volatile?

Accepted Answer

CPU registers → Cache → RAM → Swap → Disk → Remote logging → Physical media. The order of volatility prioritizes capturing data that changes most quickly first.

Answer

Physical media → Remote logging → Disk → Swap → RAM → Cache → CPU registers

Answer

Cache → CPU registers → RAM → Swap → Remote logging → Disk → Physical media

Answer

RAM → CPU registers → Cache → Swap → Disk → Remote logging → Physical media

Question 18

A company is selecting a disaster recovery site for critical applications that must be restored within 4 hours with minimal data loss. Which site type best meets these requirements?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, network connectivity, and real-time data replication, enabling recovery within minutes to hours and minimal data loss. This matches the requirement of restoring critical applications within 4 hours with minimal data loss, as hot sites maintain near-synchronous or synchronous replication (e.g., using synchronous replication over Fibre Channel or iSCSI with RPOs in seconds).

Answer

Cold site

Answer

Reciprocal agreement

Answer

Warm site

Question 19

A SOC analyst receives an alert from the SIEM indicating a large volume of outbound data from a sensitive database server to an external IP address. The analyst queries the SIEM and finds the server communicated with the external IP during non-business hours. Which type of incident is most likely occurring?

Accepted Answer

Data breach. Large outbound data transfer to an external IP outside business hours suggests a data breach, possibly exfiltration.

Answer

Unauthorized access

Answer

Denial of Service (DoS)

Answer

Malware infection

Question 20

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) determines the acceptable data loss measured in time.

Answer

MTD

Answer

MTTR

Answer

RTO