CISSP Security Operations Practice Test 4 — 15 Questions

Question 1

Which of the following is the most important factor when prioritizing vulnerability remediation in a vulnerability management program?

Accepted Answer

Exploitability and business impact. Risk-based prioritization considers exploitability and potential impact, not just CVSS score.

Answer

CVSS base score

Answer

Number of systems affected

Answer

Time since discovery

Question 2

A SOC analyst at Tier 1 identifies a potential malware infection on a user workstation. What is the next step in the standard incident response process?

Accepted Answer

Escalate the incident to Tier 2 analyst for further investigation. Tier 1 analysts typically triage alerts and escalate if they cannot resolve them.

Answer

Update the SIEM correlation rule to ignore similar alerts

Answer

Disconnect the workstation from the network immediately

Answer

Perform a deep forensic analysis of the workstation

Question 3

A security analyst is selecting forensic tools for an investigation. Which TWO tools are best suited for memory forensics? (Select TWO.)

Accepted Answer

Volatility. Volatility is a dedicated memory forensics framework; FTK can also capture and analyze memory, though it's more general. EnCase is disk forensics, Wireshark network, Autopsy disk.

Answer

Wireshark

Answer

Autopsy

Answer

EnCase

Question 4

An organization is planning its disaster recovery strategy. Which THREE options are considered recovery site types? (Select THREE.)

Accepted Answer

Hot site. Hot, warm, and cold sites are standard DR site types. Reciprocal agreements and cloud DR are strategies but not physical site types.

Answer

Cloud DR

Answer

Reciprocal agreement

Question 5

An organization is developing an incident response plan. Which component is primarily responsible for defining the criteria for escalating an incident to senior management and legal counsel?

Accepted Answer

Escalation paths. Escalation paths specify the conditions and hierarchy for notifying higher-level management and legal teams based on incident severity and impact.

Answer

Communication plan

Answer

Recovery procedures

Answer

Incident categories

Question 6

During a forensic investigation, an analyst must collect volatile data in the correct order. Which of the following sequences correctly follows the order of volatility?

Accepted Answer

CPU registers → cache → RAM → swap → disk. The order of volatility prioritizes collecting data from most volatile to least volatile to avoid loss.

Answer

Disk → RAM → CPU registers → cache → swap

Answer

RAM → CPU registers → swap → disk → remote logging

Answer

Swap → RAM → cache → CPU registers → disk

Question 7

An organization has a maximum tolerable downtime (MTD) of 8 hours for a critical application. The recovery time objective (RTO) is set to 4 hours. Which of the following best describes the purpose of the RTO?

Accepted Answer

The time within which IT systems must be restored. RTO defines the maximum time allowed to restore IT services after a disaster, ensuring the MTD is not exceeded.

Answer

The total downtime the organization can tolerate

Answer

The maximum amount of data loss acceptable

Answer

The time required to repair a failed component

Question 8

A company plans to implement a disaster recovery site that can be operational within 2 hours of a failure. Which type of DR site best meets this requirement?

Accepted Answer

Hot site. Hot sites are fully operational and can be activated within minutes to a few hours.

Answer

Warm site

Answer

Cold site

Answer

Reciprocal agreement

Question 9

Which type of digital forensics involves capturing and analyzing network traffic to investigate a security incident?

Accepted Answer

Network forensics. Network forensics focuses on monitoring and analyzing network traffic for evidence.

Answer

Media analysis

Answer

Log analysis

Answer

Memory forensics

Question 10

A security team implements a Data Loss Prevention (DLP) solution to monitor email attachments for sensitive data. Which type of DLP is being used?

Accepted Answer

Network DLP. Network DLP monitors data in motion by inspecting network traffic, such as email attachments, as they traverse the network perimeter. This is the correct type because the scenario explicitly describes monitoring email attachments, which are transmitted over the network, and Network DLP is designed to inspect SMTP, HTTP, FTP, and other protocols for sensitive content at the network layer.

Answer

Classification-based controls

Answer

Cloud DLP

Answer

Endpoint DLP

Question 11

Which of the following is a key difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

Accepted Answer

BCP ensures continuity of business operations; DRP restores IT infrastructure. BCP focuses on maintaining business functions during/after a disaster, while DRP focuses on restoring IT systems.

Answer

BCP only addresses natural disasters; DRP addresses all disasters

Answer

BCP is tested annually; DRP is tested monthly

Answer

BCP focuses on IT restoration; DRP focuses on business processes

Question 12

A security analyst is identifying incident categories for a new incident response plan. Which TWO of the following are valid incident categories according to standard IR frameworks?

Accepted Answer

Denial of Service (DoS). Common incident categories include Denial of Service, malware, data breach, insider threat, unauthorized access, and social engineering.

Answer

Change request

Answer

Patch management failure

Answer

Business continuity exercise

Question 13

During a forensic investigation, which TWO of the following are essential steps to maintain chain of custody?

Accepted Answer

Labeling evidence with date, time, and collector's name. Chain of custody requires documenting every transfer of evidence and ensuring it is signed and secured.

Answer

Storing evidence on a shared network drive

Answer

Encrypting the evidence file to prevent viewing

Answer

Performing a hash of the evidence immediately

Question 14

A SOC manager is designing a tiered incident response team. Which THREE of the following are standard roles in an incident response team according to industry best practices?

Accepted Answer

Forensic Investigator. Standard IR team roles include IR manager, security analyst, forensic investigator, communications lead, and legal counsel.

Answer

Human Resources Representative

Answer

Chief Financial Officer

Question 15

A company is implementing a Data Loss Prevention (DLP) program. Which THREE of the following are common types of DLP controls?

Accepted Answer

Network DLP. Common DLP types are network, endpoint, and cloud DLP.

Answer

Application DLP

Answer

Physical DLP