CISSP Security Operations Practice Test 2 — 15 Questions

Question 1

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. A chain of custody is a chronological record documenting who collected, handled, transferred, and analyzed evidence, along with when and why each action occurred. Its primary purpose is to preserve evidence integrity and prove in court that the evidence was not tampered with, making it admissible under rules such as the Federal Rules of Evidence (FRE 901). Without an unbroken chain, opposing counsel can challenge authenticity and the evidence may be excluded.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 2

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 performs advanced analysis, which explicitly includes deep packet inspection (DPI) and memory forensics. Confirming DNS tunneling exfiltration requires inspecting DNS query payloads for encoded data and analyzing process memory for injected malware — skills and tooling reserved for Tier 3. Tier 1 and Tier 2 handle triage and investigation but not advanced forensic analysis.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 3

A security analyst is examining a memory dump from a compromised workstation. Which TWO tools are commonly used for memory forensics?

Accepted Answer

Volatility. Volatility (C) is the de facto open-source framework for memory forensics, designed to parse raw memory images and extract artifacts such as processes, network connections, and injected code via plugins. Rekall (D) is another memory forensics framework, originally forked from Volatility, that analyzes RAM dumps for malware and rootkit indicators. Both operate directly on memory captures, which is exactly what the analyst needs. Wireshark (A) is a network protocol analyzer that inspects packet captures, not RAM dumps. EnCase (B) and FTK Imager (E) are disk imaging and file-system forensic tools, not memory analysis frameworks.

Answer

Wireshark

Answer

EnCase

Answer

FTK Imager

Question 4

An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?

Accepted Answer

Roles and responsibilities. Option A (Roles and responsibilities) is correct because an incident response plan must define who does what during an incident, assigning clear ownership of tasks such as detection, triage, containment, eradication, and recovery so that actions are not duplicated or missed. Option D (Communication plan) is correct because it specifies internal and external notification paths, escalation thresholds, contact trees, and stakeholder/customer/regulator messaging, which is essential for coordinated response and meeting breach-notification obligations. Option E (Recovery procedures) is correct because the plan must document the steps to restore affected systems and services to normal operation, including validation, prioritization, and return-to-production criteria. Option B (Vendor product list) is not a required component; while asset and vendor inventories can support response, a mere product list is not part of the core plan structure. Option C (Employee performance reviews) is unrelated to incident response and belongs to HR performance management, not the IR plan.

Answer

Vendor product list

Answer

Employee performance reviews

Question 5

A company is designing a disaster recovery strategy for its e-commerce platform. The platform requires an RTO of 2 hours and an RPO of 15 minutes. Which TWO strategies would BEST meet these requirements?

Accepted Answer

Cloud DR with continuous data replication. Option B (Cloud DR with continuous data replication) is correct because continuous replication keeps the standby environment's data within minutes of the primary, satisfying the 15-minute RPO, while cloud-based failover can typically be initiated well within the 2-hour RTO. Option D (Hot site with real-time replication) is correct because a hot site is fully provisioned and ready to take over immediately, and real-time replication keeps data loss near zero, comfortably meeting both the 2-hour RTO and 15-minute RPO. Option A (Tape backup restoration) is not suitable because restoring from tape is slow and typically yields RTOs measured in days and RPOs in hours or days, far exceeding the targets. Option C (Cold site) fails because it lacks pre-installed infrastructure and requires lengthy setup, making the 2-hour RTO unachievable. Option E (Warm site) is closer but still requires some configuration and its periodic replication usually cannot guarantee a 15-minute RPO.

Answer

Tape backup restoration

Answer

Cold site

Answer

Warm site

Question 6

An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?

Accepted Answer

Incident categories. Incident categories define the classification scheme that specifies what types of events constitute an incident and how they are grouped (e.g., malware, DoS, unauthorized access). This component establishes the conditions and thresholds that trigger incident declaration, making it the correct answer for 'defining the specific conditions that constitute an incident.' Categories also drive escalation paths and response procedures.

Answer

Communication plan

Answer

Recovery procedures

Answer

Legal notification requirements

Question 7

A company is selecting a disaster recovery site for critical applications that must be restored within 4 hours with minimal data loss. Which site type best meets these requirements?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, network connectivity, and real-time data replication, enabling recovery within minutes to hours and minimal data loss. This matches the requirement of restoring critical applications within 4 hours with minimal data loss, as hot sites maintain near-synchronous or synchronous replication (e.g., using synchronous replication over Fibre Channel or iSCSI with RPOs in seconds).

Answer

Cold site

Answer

Reciprocal agreement

Answer

Warm site

Question 8

A SOC analyst receives an alert from the SIEM indicating a large volume of outbound data from a sensitive database server to an external IP address. The analyst queries the SIEM and finds the server communicated with the external IP during non-business hours. Which type of incident is most likely occurring?

Accepted Answer

Data breach. Large outbound data transfers from a sensitive database server to an external IP during non-business hours strongly indicate exfiltration, which is the hallmark of a data breach. The volume, sensitivity of the source, and off-hours timing all point to unauthorized data movement rather than other incident types.

Answer

Unauthorized access

Answer

Denial of Service (DoS)

Answer

Malware infection

Question 9

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time — for example, an RPO of 4 hours means the organization can tolerate losing up to 4 hours of data. It directly drives backup frequency and replication strategy. RTO, by contrast, defines how long recovery can take, not how much data can be lost.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 10

A security team is implementing data loss prevention (DLP) to protect sensitive information. Which DLP type is best suited to monitor and block sensitive data leaving the corporate network via email or web traffic?

Accepted Answer

Network DLP. Network DLP is designed to monitor and control data in transit across network boundaries, including email and web traffic. It inspects packets leaving the corporate network to detect and block sensitive data exfiltration. Therefore, it is best suited for monitoring and blocking sensitive data leaving via email or web traffic.

Answer

Cloud DLP

Answer

Endpoint DLP

Answer

Classification-based controls

Question 11

Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?

Accepted Answer

Communications lead. The communications lead is the incident response team role specifically tasked with managing all external and internal communications, including press releases, media inquiries, and regulator notifications. This role ensures a single, consistent message and prevents unauthorized disclosures. Legal counsel, the incident manager, and forensic investigators have different primary responsibilities that do not center on external communications.

Answer

Legal counsel

Answer

Incident manager

Answer

Forensic investigator

Question 12

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business processes during a disruption. A Business Continuity Plan (BCP) is broader in scope and focuses on maintaining critical business processes — people, facilities, suppliers, and operations — during and after a disruption. The Disaster Recovery Plan (DRP) is a subset focused specifically on restoring IT systems and infrastructure. Thus, maintaining critical business processes is the BCP's primary focus.

Answer

Securing physical facilities

Answer

Restoring IT systems and infrastructure

Answer

Replacing hardware and software

Question 13

An organization is implementing a patch management process. Which of the following is the most critical step to ensure that patches do not disrupt critical business operations?

Accepted Answer

Integrating patch deployment with change management. Integrating patch deployment with change management ensures patches are assessed, approved, scheduled, and rolled back if needed, which is the most critical step to avoid disrupting critical business operations. Change management provides the governance and risk review that prevents untested patches from breaking production.

Answer

Applying patches as soon as they are released

Answer

Scanning for vulnerabilities weekly

Answer

Using automated patch tools

Question 14

Which digital forensics tool is specifically designed for memory forensics?

Accepted Answer

Volatility. Volatility is the leading open-source memory forensics framework, designed to analyze RAM dumps (e.g., from LiME, WinPmem, or hibernation files) to extract running processes, network connections, injected code, and encryption keys. It parses memory structures using profiles or symbol tables to reconstruct system state. This makes it the tool specifically built for memory forensics.

Answer

Wireshark

Answer

EnCase

Answer

FTK

Question 15

A security analyst is reviewing SIEM logs and notices multiple failed login attempts from a single IP address followed by a successful login. The account belongs to a user in finance. Which incident category is most appropriate?

Accepted Answer

Unauthorized access. The sequence of multiple failed login attempts followed by a successful login from the same external IP address indicates a brute-force or password-spraying attack that succeeded. This constitutes unauthorized access because the attacker gained entry to an account without legitimate authorization, violating the confidentiality and integrity of the finance user's account.

Answer

DoS

Answer

Insider threat

Answer

Social engineering