CISSP Security Operations Practice Test 3 — 15 Questions

Question 1

What is the primary purpose of a Change Advisory Board (CAB) in change management?

Accepted Answer

To approve and oversee changes to IT systems. The CAB is a governance body whose core function is to review, evaluate, and formally approve or reject proposed changes to IT systems before they are implemented. It balances the need for change against risk and business impact, ensuring changes are authorized, prioritized, and scheduled appropriately. This approval/oversight role is distinct from actually performing the change or handling security operations.

Answer

To conduct vulnerability assessments

Answer

To implement changes in the IT environment

Answer

To respond to security incidents

Question 2

An organization is designing a security operations center (SOC) with three tiers. Which TWO of the following are typical responsibilities of Tier 1 analysts? (Select TWO)

Accepted Answer

Monitoring SIEM alerts and performing initial triage. Option B is correct because Tier 1 analysts are the first line of defense in a SOC, continuously monitoring SIEM alerts and performing initial triage to determine whether an alert is a true positive, false positive, or benign event. Option C is correct because a core Tier 1 responsibility is escalating validated or suspicious incidents to Tier 2 for deeper investigation when the alert exceeds their scope or requires advanced analysis. Threat hunting (A) is typically performed by Tier 2 or Tier 3 analysts who proactively search for hidden threats rather than react to alerts. In-depth forensic analysis (D) is a Tier 3 or dedicated incident response function requiring specialized tools and expertise. Developing new detection rules for the SIEM (E) is usually the responsibility of Tier 2/Tier 3 analysts or detection engineers, not Tier 1.

Answer

Performing threat hunting

Answer

Conducting in-depth forensic analysis

Answer

Developing new detection rules for the SIEM

Question 3

A company is evaluating disaster recovery strategies and wants to minimize both RTO and RPO. Which THREE options provide the best combination of low RTO and low RPO? (Select THREE)

Accepted Answer

Cloud DR with replication. Option B (Cloud DR with replication) is correct because continuously replicating workloads and data to a cloud region keeps a near-current copy of the environment, allowing rapid failover for a low RTO and minimal data loss for a low RPO. Option C (Synchronous replication to a secondary site) is correct because synchronous replication only acknowledges writes once they are committed at both sites, giving an RPO of essentially zero, and the mirrored secondary site can be activated quickly for a low RTO. Option D (Hot site) is correct because a hot site is a fully operational duplicate facility with current data and ready-to-run systems, enabling failover in minutes or hours (low RTO) with little to no data loss (low RPO). Option A (Reciprocal agreement) does not belong because it relies on another organization's idle capacity that may not be available or current during a disaster, yielding high RTO and RPO. Option E (Cold site) does not belong because it provides only basic space and power with no pre-installed systems or data, requiring lengthy setup and restoration, which produces the highest RTO and RPO.

Answer

Reciprocal agreement

Answer

Cold site

Question 4

Which of the following best describes the primary purpose of an incident response plan?

Accepted Answer

To provide a structured approach for managing and resolving security incidents. An incident response plan provides a structured approach to manage and resolve security incidents, minimizing impact.

Answer

To replace the need for a disaster recovery plan

Answer

To assign blame after an incident occurs

Answer

To document all security controls in place

Question 5

During a digital forensics investigation, which of the following data sources has the highest order of volatility?

Accepted Answer

CPU registers. CPU registers have the highest order of volatility because they hold the most transient data — values change with every instruction cycle and are lost when power is removed or the process is context-switched. In digital forensics, the order of volatility (RFC 3227) dictates that you collect the most volatile data first, starting with CPU registers and cache, then memory, then network state, then disk.

Answer

Remote logging server

Answer

Network packets in transit

Answer

Hard disk drive

Question 6

An organization has a maximum tolerable downtime (MTD) of 8 hours for its critical e-commerce platform. The recovery time objective (RTO) is set to 4 hours, and the recovery point objective (RPO) is 30 minutes. Which disaster recovery strategy is most cost-effective while meeting these requirements?

Accepted Answer

Cloud DR with continuous replication. Cloud DR with continuous replication meets the RPO of 30 minutes because data is replicated in near real-time, resulting in minimal data loss. It can also meet the RTO of 4 hours if automated failover and resource provisioning are configured. This approach is more cost-effective than a hot site because it avoids maintaining idle infrastructure and only incurs costs during actual disaster recovery operations. Hot site with real-time replication (option B) also meets the requirements but is more expensive. Cold site with daily backups (option C) fails both RTO and RPO. Warm site with hourly backups (option D) fails RPO because it can result in up to 1 hour of data loss, exceeding the 30-minute limit.

Answer

Hot site with real-time replication

Answer

Cold site with daily backups

Answer

Warm site with hourly backups

Question 7

Which of the following is the primary purpose of a Change Advisory Board (CAB)?

Accepted Answer

To provide oversight and approval for significant changes. The Change Advisory Board (CAB) exists to review, assess, and approve significant changes before they are deployed, providing governance and risk oversight across the IT environment. Its primary purpose is oversight and approval, not hands-on implementation or incident review. This aligns with ITIL change enablement practices, where the CAB advises the change authority on risk and impact.

Answer

To implement changes as requested by management

Answer

To review security incidents after they occur

Answer

To approve all changes to the production environment

Question 8

What type of DLP system monitors data in motion across the network?

Accepted Answer

Network DLP. Network DLP (A) is designed to monitor data in motion across the network, inspecting traffic for sensitive information being transmitted. It sits at network egress points and analyzes protocols like HTTP, SMTP, and FTP to prevent data exfiltration. This directly matches the requirement to monitor data in motion.

Answer

Storage DLP

Answer

Endpoint DLP

Answer

Cloud DLP

Question 9

An organization's security operations center (SOC) uses a SIEM to correlate logs. The SOC manager wants to automate response actions for low-severity alerts. Which technology would best support this goal?

Accepted Answer

SOAR platform. A SOAR (Security Orchestration, Automation, and Response) platform is designed to ingest alerts from SIEM and other sources, apply playbooks, and execute automated response actions such as disabling accounts, blocking IPs, or opening tickets. It is the technology category purpose-built for automating low-severity alert triage and response. SIEM correlates and detects; SOAR orchestrates and acts.

Answer

Network firewall

Answer

Threat intelligence platform

Answer

Vulnerability scanner

Question 10

During a forensic investigation, the investigator must ensure that evidence is properly handled and documented. What is the primary purpose of maintaining a chain of custody?

Accepted Answer

To document who accessed the evidence and when. The chain of custody is a documented record of who handled evidence, when, where, and for what purpose, from collection through presentation in court. Its primary purpose is to preserve the integrity and admissibility of evidence by showing an unbroken sequence of custody (B). Without it, opposing counsel can challenge that evidence was tampered with or contaminated.

Answer

To speed up the investigation process

Answer

To encrypt the evidence at rest

Answer

To store evidence in a fireproof safe

Question 11

An organization is designing its incident response team roles. Which role is primarily responsible for collecting and preserving evidence for legal proceedings?

Accepted Answer

Forensic investigator. The forensic investigator is specifically trained to identify, collect, preserve, and document digital evidence using forensically sound methods that maintain chain of custody and evidentiary integrity. This role ensures evidence is admissible in legal or disciplinary proceedings. Other incident response roles focus on coordination, communication, or analysis rather than legal evidence handling.

Answer

Communications lead

Answer

Incident manager

Answer

Security analyst

Question 12

Which of the following is an example of a social engineering attack?

Accepted Answer

A phishing email requesting credentials. Phishing is a social engineering attack that manipulates human psychology to trick users into revealing credentials or clicking malicious links. It relies on deception and trust rather than technical exploitation, which is the defining characteristic of social engineering.

Answer

A brute-force attack on a password

Answer

SQL injection on a web application

Answer

A DDoS attack on a server

Question 13

An organization wants to ensure that its critical database can be restored to a point within the last 15 minutes in case of failure. Which metric defines this requirement?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time — i.e., how far back a restore point can be. A requirement to restore to a point within the last 15 minutes is precisely an RPO of 15 minutes, dictating backup/replication frequency. RTO, by contrast, defines how quickly service must be restored, not how much data can be lost.

Answer

MTD

Answer

MTTR

Answer

RTO

Question 14

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Prioritizing vulnerability remediation should be driven by exploitability (is there a known exploit, is it weaponized, is it reachable) combined with business impact (what asset is affected, what data or process is at risk). This risk-based approach ensures limited remediation resources are directed at the vulnerabilities that pose the greatest actual threat to the organization. CVSS alone does not capture business context.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 15

A SOC analyst at Tier 1 identifies a potential malware infection on a user workstation. What is the next step in the standard incident response process?

Accepted Answer

Escalate the incident to Tier 2 analyst for further investigation. Tier 1 analysts typically triage alerts and escalate if they cannot resolve them.

Answer

Update the SIEM correlation rule to ignore similar alerts

Answer

Disconnect the workstation from the network immediately

Answer

Perform a deep forensic analysis of the workstation