CISSP Security Operations — 25 Questions

Question 1

During a security incident, an organization's SOC team identifies a series of unauthorized access attempts from an external IP address. The incident manager needs to escalate this to the appropriate team. According to the incident response plan, which role is primarily responsible for coordinating the response and communicating with stakeholders?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident manager. The Incident Manager is responsible for the overall coordination of the incident response effort, directing resources, and acting as the primary point of contact for communicating status updates to stakeholders and management. SOC analysts detect and escalate incidents, while forensic investigators analyze evidence, and the communications lead typically handles public relations rather than overall response coordination.

Answer

Forensic investigator

Answer

Communications lead

Answer

SOC Tier 1 analyst

Question 2

A security analyst is examining a memory dump from a compromised workstation. Which TWO tools are commonly used for memory forensics?

Accepted Answer

Volatility. Volatility (C) and Rekall (D) are both specialized, open-source memory forensics frameworks used to analyze volatile memory (RAM) dumps to extract running processes, active network connections, loaded DLLs, and registry hives. While tools like FTK Imager (E) can capture memory, and EnCase (B) is used for broader digital forensics, Volatility and Rekall are specifically designed for deep memory analysis.

Answer

Wireshark

Answer

EnCase

Answer

FTK Imager

Question 3

A security analyst is reviewing SIEM logs and notices multiple failed login attempts from a single IP address followed by a successful login. The account belongs to a user in finance. Which incident category is most appropriate?

Accepted Answer

Unauthorized access. The sequence of multiple failed login attempts followed by a successful login from the same external IP address indicates a brute-force or password-spraying attack that succeeded. This constitutes unauthorized access because the attacker gained entry to an account without legitimate authorization, violating the confidentiality and integrity of the finance user's account.

Answer

DoS

Answer

Insider threat

Answer

Social engineering

Question 4

During a forensic investigation, which THREE of the following are essential to maintain chain of custody? (Select THREE)

Accepted Answer

Documenting every person who handled the evidence. To maintain both the integrity of digital evidence and its chain of custody, investigators must document every person who handled the evidence (Option B), record the date and time of each transfer (Option E), and use write-blockers during acquisition (Option C) to ensure the original media is not altered. Storing evidence in public locations (Option A) or encrypting it at all times (Option D) are either insecure or not strictly required/feasible for all evidence types.

Answer

Storing evidence in a publicly accessible location

Answer

Encrypting the evidence at all times

Question 5

A security manager is reviewing incident categories for inclusion in the incident response plan. Which THREE of the following are common incident categories? (Select THREE.)

Accepted Answer

Malware. According to standard incident classification frameworks (such as US-CERT and NIST SP 800-61), the primary incident categories include Unauthorized Access, Malicious Code (Malware), and Denial of Service (DoS). Social engineering is considered an attack vector (the method used to initiate an attack), and a data breach is an outcome or impact of an incident (specifically, unauthorized access to sensitive data) rather than a primary incident category itself.

Answer

Data breach

Answer

Social engineering

Question 6

A SOC analyst (Tier 1) receives an alert from the SIEM indicating a potential malware infection on a critical server. According to SOC tier responsibilities, what is the analyst's primary action?

Accepted Answer

Isolate the server and then escalate to Tier 2. Tier 1 SOC analysts are responsible for continuous monitoring, initial triage, and validating alerts to filter out false positives. Once an alert on a critical server is validated as a true positive, they escalate it to Tier 2 (Incident Responders) who have the authority and expertise to perform containment actions like isolation. Unilaterally isolating a critical server at Tier 1 violates change control and availability requirements.

Answer

Perform in-depth forensic analysis of the server

Answer

Implement a permanent firewall rule to block the malware

Answer

Delete the malware sample without preserving evidence

Question 7

A Change Advisory Board (CAB) is evaluating a request to implement a critical security patch. Which RACI element is typically assigned to the CAB for the 'Approve' activity?

Accepted Answer

Consulted. In both ITIL and RACI frameworks, the Change Advisory Board (CAB) is a consultative body. Its role is to advise, review, and recommend actions on changes—making them 'Consulted' (C). The ultimate decision-making authority and sign-off ('Approve') rests with a single individual, typically the Change Manager or a Service Owner, who is 'Accountable' (A). Assigning 'Accountable' to a collective board is a major RACI anti-pattern, as accountability must lie with a single individual.

Answer

Responsible

Answer

Informed

Answer

Accountable

Question 8

A company is selecting a disaster recovery strategy for a mission-critical application. Which TWO of the following strategies provide the shortest recovery time objective (RTO)?

Accepted Answer

Hot site. A hot site is a fully operational facility with real-time data replication and pre-configured hardware/software, allowing for near-instantaneous failover (RTO of minutes or hours). Similarly, Cloud DR with pre-configured instances (such as warm standby or hot standby in the cloud) allows rapid spin-up of resources with minimal data loss and very low RTO. In contrast, warm sites require restoration of backups (longer RTO), cold sites require complete hardware setup (longest RTO), and reciprocal agreements are notoriously difficult to enforce and slow to implement.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 9

A security analyst is configuring a SIEM to improve threat detection. Which THREE of the following are essential capabilities of a SIEM system?

Accepted Answer

Reporting and dashboarding. Log aggregation and normalization (E) is the foundational capability of a SIEM, collecting diverse log data and standardizing it into a common format. Real-time correlation and alerting (D) analyzes this normalized data to identify patterns of suspicious activity and trigger immediate alerts. Reporting and dashboarding (C) visualizes this data for compliance and security posture monitoring. Vulnerability scanning (A) and automated patch deployment (B) are functions of vulnerability and patch management systems, not core SIEM capabilities.

Answer

Vulnerability scanning

Answer

Automated patch deployment

Question 10

An organization's disaster recovery plan specifies a Recovery Time Objective (RTO) of 4 hours for its critical financial application. Which disaster recovery site would be MOST appropriate to meet this RTO?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling the critical financial application to be operational within minutes to a few hours. With an RTO of 4 hours, a hot site provides the necessary infrastructure and up-to-date data to meet this stringent recovery timeline, as cold and warm sites require significant setup and data restoration time.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 11

A forensic investigator arrives at a crime scene involving a compromised server. The server is still running. According to the order of volatility, which of the following should the investigator capture FIRST?

Accepted Answer

CPU registers. CPU registers are the most volatile and must be captured first to preserve critical evidence.

Answer

RAM contents

Answer

Hard disk contents

Answer

Network connections

Question 12

Which of the following BEST describes the difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures business functions continue, DRP restores IT operations. D is correct because the Business Continuity Plan (BCP) focuses on maintaining critical business functions during and after a disruption, ensuring minimal impact on operations, while the Disaster Recovery Plan (DRP) is a subset of BCP that specifically addresses the restoration of IT infrastructure, systems, and data after a disaster. The BCP encompasses broader organizational resilience, including manual workarounds and alternate sites, whereas the DRP targets technical recovery procedures such as system rebuilds, data restoration from backups, and failover to redundant systems.

Answer

BCP deals with natural disasters, DRP deals with cyberattacks

Answer

BCP is for IT systems, DRP is for business processes

Answer

BCP is a subset of DRP

Question 13

A SOC team is using a SIEM to correlate events from multiple sources. They want to automate responses to common threats. Which technology should they integrate to achieve security orchestration and automation?

Accepted Answer

SOAR. SOAR tools automate and orchestrate security responses, integrating with SIEM.

Answer

Vulnerability scanner

Answer

Endpoint detection and response (EDR)

Answer

Network-based IDS

Question 14

An organization's data loss prevention (DLP) solution is configured to block emails containing credit card numbers. This is an example of which type of DLP control?

Accepted Answer

Network DLP. Network DLP monitors and controls data in motion, such as email traffic.

Answer

Classification-based DLP

Answer

Cloud DLP

Answer

Endpoint DLP

Question 15

During a vulnerability management lifecycle, after vulnerabilities are identified and prioritized, what is the NEXT step?

Accepted Answer

Remediation. Remediation (patching or mitigating) follows prioritization.

Answer

Verification

Answer

Reporting

Answer

Risk acceptance

Question 16

Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?

Accepted Answer

RPO. RPO defines the acceptable data loss in terms of time.

Answer

MTTR

Answer

RTO

Answer

MTD

Question 17

An organization is implementing a change management process. Which group is responsible for reviewing and approving major changes?

Accepted Answer

Change Advisory Board (CAB). The Change Advisory Board (CAB) is the formal group within ITIL-based change management responsible for reviewing, assessing, and approving major or high-risk changes. Major changes typically require a CAB meeting to evaluate impact, resource requirements, and rollback plans before authorization. This ensures changes do not introduce security vulnerabilities or disrupt critical operations.

Answer

Project management office

Answer

Incident response team

Answer

Security operations center

Question 18

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. Chain of custody ensures evidence integrity through documentation of handling.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 19

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 20

An organization is recovering from a ransomware attack that encrypted critical servers. The backup strategy must ensure that the Recovery Point Objective (RPO) of 1 hour is met. Which backup method is MOST appropriate?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) captures changes in real time, meeting a 1-hour RPO.

Answer

Daily full backups

Answer

Weekly full backups with daily differentials

Answer

Snapshot every 4 hours