CISSP Security Operations Practice Test 2 — 15 Questions

Question 1

Which of the following metrics is used to determine the maximum amount of data loss an organization can tolerate in a disaster?

Accepted Answer

RPO. RPO defines the acceptable data loss in terms of time.

Answer

MTTR

Answer

RTO

Answer

MTD

Question 2

An organization is implementing a change management process. Which group is responsible for reviewing and approving major changes?

Accepted Answer

Change Advisory Board (CAB). The Change Advisory Board (CAB) is the formal group within ITIL-based change management responsible for reviewing, assessing, and approving major or high-risk changes. Major changes typically require a CAB meeting to evaluate impact, resource requirements, and rollback plans before authorization. This ensures changes do not introduce security vulnerabilities or disrupt critical operations.

Answer

Project management office

Answer

Incident response team

Answer

Security operations center

Question 3

What is the PRIMARY purpose of a chain of custody in digital forensics?

Accepted Answer

To maintain evidence integrity and admissibility in court. Chain of custody ensures evidence integrity through documentation of handling.

Answer

To document the tools used during investigation

Answer

To identify the perpetrator of a cybercrime

Answer

To speed up the forensic analysis process

Question 4

A SOC has three tiers: Tier 1 triages alerts, Tier 2 investigates, and Tier 3 performs advanced analysis. An alert about a potential data exfiltration using DNS tunneling is escalated from Tier 1. Which tier is BEST suited to perform deep packet inspection and memory forensics to confirm the exfiltration?

Accepted Answer

Tier 3. Tier 3 handles advanced analysis including memory forensics.

Answer

Incident manager

Answer

Tier 2

Answer

Tier 1

Question 5

An organization is recovering from a ransomware attack that encrypted critical servers. The backup strategy must ensure that the Recovery Point Objective (RPO) of 1 hour is met. Which backup method is MOST appropriate?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) captures changes in real time, meeting a 1-hour RPO.

Answer

Daily full backups

Answer

Weekly full backups with daily differentials

Answer

Snapshot every 4 hours

Question 6

An organization is updating its incident response plan. According to best practices, which THREE components should be included in the plan?

Accepted Answer

Roles and responsibilities. An IR plan should include roles, communication plan, and recovery procedures.

Answer

Vendor product list

Answer

Employee performance reviews

Question 7

A company is designing a disaster recovery strategy for its e-commerce platform. The platform requires an RTO of 2 hours and an RPO of 15 minutes. Which TWO strategies would BEST meet these requirements?

Accepted Answer

Cloud DR with continuous data replication. Hot site and cloud DR with continuous replication can meet aggressive RTO/RPO.

Answer

Tape backup restoration

Answer

Cold site

Answer

Warm site

Question 8

An organization is developing an incident response plan. Which component is responsible for defining the specific conditions that constitute an incident?

Accepted Answer

Incident categories. Incident categories define what events are considered incidents, enabling consistent classification and response.

Answer

Communication plan

Answer

Recovery procedures

Answer

Legal notification requirements

Question 9

During a digital forensics investigation, a security analyst must preserve evidence in order of volatility. Which of the following represents the correct sequence from most volatile to least volatile?

Accepted Answer

CPU registers → Cache → RAM → Swap → Disk → Remote logging → Physical media. The order of volatility prioritizes capturing data that changes most quickly first.

Answer

Physical media → Remote logging → Disk → Swap → RAM → Cache → CPU registers

Answer

Cache → CPU registers → RAM → Swap → Remote logging → Disk → Physical media

Answer

RAM → CPU registers → Cache → Swap → Disk → Remote logging → Physical media

Question 10

A company is selecting a disaster recovery site for critical applications that must be restored within 4 hours with minimal data loss. Which site type best meets these requirements?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, network connectivity, and real-time data replication, enabling recovery within minutes to hours and minimal data loss. This matches the requirement of restoring critical applications within 4 hours with minimal data loss, as hot sites maintain near-synchronous or synchronous replication (e.g., using synchronous replication over Fibre Channel or iSCSI with RPOs in seconds).

Answer

Cold site

Answer

Reciprocal agreement

Answer

Warm site

Question 11

A SOC analyst receives an alert from the SIEM indicating a large volume of outbound data from a sensitive database server to an external IP address. The analyst queries the SIEM and finds the server communicated with the external IP during non-business hours. Which type of incident is most likely occurring?

Accepted Answer

Data breach. Large outbound data transfer to an external IP outside business hours suggests a data breach, possibly exfiltration.

Answer

Unauthorized access

Answer

Denial of Service (DoS)

Answer

Malware infection

Question 12

Which metric defines the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. Recovery Point Objective (RPO) determines the acceptable data loss measured in time.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 13

A security team is implementing data loss prevention (DLP) to protect sensitive information. Which DLP type is best suited to monitor and block sensitive data leaving the corporate network via email or web traffic?

Accepted Answer

Network DLP. Network DLP inspects traffic at egress points to prevent unauthorized data transmission.

Answer

Cloud DLP

Answer

Endpoint DLP

Answer

Classification-based controls

Question 14

Which role in an incident response team is primarily responsible for coordinating communication with external parties, such as the media and regulators?

Accepted Answer

Communications lead. The communications lead manages external messaging during an incident.

Answer

Legal counsel

Answer

Incident manager

Answer

Forensic investigator

Question 15

A business continuity plan (BCP) differs from a disaster recovery plan (DRP) in that the BCP primarily focuses on:

Accepted Answer

Maintaining critical business processes during a disruption. BCP aims to maintain business functions during and after a disruption, while DRP focuses on IT restoration.

Answer

Securing physical facilities

Answer

Restoring IT systems and infrastructure

Answer

Replacing hardware and software