CISSP Security Operations Practice Test 3 — 15 Questions

Question 1

An organization is implementing a patch management process. Which of the following is the most critical step to ensure that patches do not disrupt critical business operations?

Accepted Answer

Integrating patch deployment with change management. Change management ensures patches are tested and approved before deployment, minimizing operational impact.

Answer

Applying patches as soon as they are released

Answer

Scanning for vulnerabilities weekly

Answer

Using automated patch tools

Question 2

Which digital forensics tool is specifically designed for memory forensics?

Accepted Answer

Volatility. Volatility is an open-source framework for extracting artifacts from RAM dumps.

Answer

Wireshark

Answer

EnCase

Answer

FTK

Question 3

What is the primary purpose of a Change Advisory Board (CAB) in change management?

Accepted Answer

To approve and oversee changes to IT systems. The CAB reviews and approves changes to ensure they are properly assessed and minimize risk.

Answer

To conduct vulnerability assessments

Answer

To implement changes in the IT environment

Answer

To respond to security incidents

Question 4

An organization is designing a security operations center (SOC) with three tiers. Which TWO of the following are typical responsibilities of Tier 1 analysts? (Select TWO)

Accepted Answer

Monitoring SIEM alerts and performing initial triage. Tier 1 analysts monitor alerts, perform initial triage, and escalate as needed.

Answer

Performing threat hunting

Answer

Conducting in-depth forensic analysis

Answer

Developing new detection rules for the SIEM

Question 5

A company is evaluating disaster recovery strategies and wants to minimize both RTO and RPO. Which THREE options provide the best combination of low RTO and low RPO? (Select THREE)

Accepted Answer

Cloud DR with replication. Hot sites, cloud DR, and replication provide rapid recovery with minimal data loss.

Answer

Reciprocal agreement

Answer

Cold site

Question 6

Which of the following best describes the primary purpose of an incident response plan?

Accepted Answer

To provide a structured approach for managing and resolving security incidents. An incident response plan provides a structured approach to manage and resolve security incidents, minimizing impact.

Answer

To replace the need for a disaster recovery plan

Answer

To assign blame after an incident occurs

Answer

To document all security controls in place

Question 7

During a digital forensics investigation, which of the following data sources has the highest order of volatility?

Accepted Answer

CPU registers. CPU registers hold the most volatile data, followed by cache, RAM, swap, disk, remote logging, and physical media.

Answer

Remote logging server

Answer

Network packets in transit

Answer

Hard disk drive

Question 8

An organization has a maximum tolerable downtime (MTD) of 8 hours for its critical e-commerce platform. The recovery time objective (RTO) is set to 4 hours, and the recovery point objective (RPO) is 30 minutes. Which disaster recovery strategy is most cost-effective while meeting these requirements?

Accepted Answer

Cloud DR with continuous replication. Cloud DR with continuous replication meets the RPO of 30 minutes because data is replicated in near real-time, resulting in minimal data loss. It can also meet the RTO of 4 hours if automated failover and resource provisioning are configured. This approach is more cost-effective than a hot site because it avoids maintaining idle infrastructure and only incurs costs during actual disaster recovery operations. Hot site with real-time replication (option B) also meets the requirements but is more expensive. Cold site with daily backups (option C) fails both RTO and RPO. Warm site with hourly backups (option D) fails RPO because it can result in up to 1 hour of data loss, exceeding the 30-minute limit.

Answer

Hot site with real-time replication

Answer

Cold site with daily backups

Answer

Warm site with hourly backups

Question 9

Which of the following is the primary purpose of a Change Advisory Board (CAB)?

Accepted Answer

To provide oversight and approval for significant changes. The CAB reviews and approves changes to ensure they are properly assessed and minimize risk.

Answer

To implement changes as requested by management

Answer

To review security incidents after they occur

Answer

To approve all changes to the production environment

Question 10

What type of DLP system monitors data in motion across the network?

Accepted Answer

Network DLP. Network DLP inspects network traffic for sensitive data leaving the organization.

Answer

Storage DLP

Answer

Endpoint DLP

Answer

Cloud DLP

Question 11

An organization's security operations center (SOC) uses a SIEM to correlate logs. The SOC manager wants to automate response actions for low-severity alerts. Which technology would best support this goal?

Accepted Answer

SOAR platform. SOAR (Security Orchestration, Automation and Response) enables automated playbooks for incident response.

Answer

Network firewall

Answer

Threat intelligence platform

Answer

Vulnerability scanner

Question 12

During a forensic investigation, the investigator must ensure that evidence is properly handled and documented. What is the primary purpose of maintaining a chain of custody?

Accepted Answer

To document who accessed the evidence and when. Chain of custody ensures evidence integrity and admissibility in legal proceedings.

Answer

To speed up the investigation process

Answer

To encrypt the evidence at rest

Answer

To store evidence in a fireproof safe

Question 13

An organization is designing its incident response team roles. Which role is primarily responsible for collecting and preserving evidence for legal proceedings?

Accepted Answer

Forensic investigator. The forensic investigator is trained to handle evidence collection and preservation.

Answer

Communications lead

Answer

Incident manager

Answer

Security analyst

Question 14

Which of the following is an example of a social engineering attack?

Accepted Answer

A phishing email requesting credentials. Social engineering exploits human psychology to gain information or access.

Answer

A brute-force attack on a password

Answer

SQL injection on a web application

Answer

A DDoS attack on a server

Question 15

An organization wants to ensure that its critical database can be restored to a point within the last 15 minutes in case of failure. Which metric defines this requirement?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the acceptable data loss in terms of time.

Answer

MTD

Answer

MTTR

Answer

RTO