CISSP Security Operations — 15 Questions

Question 1

A security analyst notices repeated failed login attempts from an internal IP address on the domain controller. After enabling account lockout, the lockouts continue but the source IP changes. What is the best next step?

Accepted Answer

Analyze the log events to identify the attack pattern and implement additional controls such as MFA. Option A is correct because the changing source IP indicates a distributed attack, likely a password spraying or brute-force attempt from multiple compromised hosts. Analyzing log events helps identify the attack pattern (e.g., timing, targeted accounts, source IP ranges) so you can implement additional controls like MFA, which mitigates credential-based attacks regardless of source IP changes. Account lockout alone is insufficient when attackers rotate IPs, as lockout policies are per-account and per-source, not adaptive to distributed sources.

Answer

Increase the account lockout threshold

Answer

Ignore the event as it is likely a false positive

Answer

Disable the user account being targeted

Question 2

A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?

Accepted Answer

Isolate the server from the network. Option A is correct because isolating the server immediately contains the threat, preventing potential data exfiltration or lateral movement from a compromised host. The suspicious outbound connection from a DMZ server to an external IP on port 443 (HTTPS) combined with 'svchost.exe' running from a non-standard path strongly indicates malware masquerading as a legitimate Windows process. In security operations, containment is the priority before investigation to minimize damage.

Answer

Initiate a full incident response investigation

Answer

Disregard the alert because svchost.exe is a legitimate Windows process

Answer

Terminate the suspicious process

Question 3

During a security audit, an organization discovers that several employees are sharing a single generic account to access a critical database. Which principle of security operations is being violated?

Accepted Answer

Accountability. Accountability requires that each individual user be uniquely identified and their actions traceable. Sharing a generic account breaks this chain because the audit logs cannot attribute specific database operations (e.g., SELECT, UPDATE, DELETE) to a particular employee, making it impossible to hold anyone responsible for misuse or errors.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 4

A security engineer is designing a new SIEM correlation rule to detect potential data exfiltration. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address within a 5-minute window, but only if the external IP is not on a whitelist of known business partners. Which approach best minimizes false positives while ensuring effective detection?

Accepted Answer

Use a baseline of normal traffic per host and trigger only when the volume exceeds the baseline by a significant margin. Option C is correct because using a baseline of normal traffic per host adapts to different users' behaviors, reducing false positives from legitimate large transfers. Option A is wrong because applying the rule to all internal hosts would generate many false positives from servers that routinely transfer large files. Option B is wrong because a static threshold does not account for varying normal usage. Option D is wrong because excluding only known partner IPs may miss exfiltration to unknown but legitimate external services.

Answer

Apply the rule to all internal hosts with the same threshold

Answer

Trigger only when the destination IP is in a threat intelligence feed of known malicious IPs

Answer

Set a static threshold of 10 MB for all hosts, but exclude traffic to common cloud storage providers

Question 5

A company's security policy requires that all removable media be encrypted. An employee plugs in a USB drive and is prompted to format it before use. After formatting, the drive is not encrypted. What is the most likely reason?

Accepted Answer

The employee did not enable encryption (e.g., BitLocker To Go) after formatting. Option A is correct because BitLocker To Go, the native encryption feature for removable drives in Windows, is not automatically enabled when a USB drive is formatted. The employee must explicitly enable encryption (e.g., via BitLocker To Go in Control Panel or by right-clicking the drive and selecting 'Turn on BitLocker') after formatting. Without this step, the drive remains unencrypted, violating the security policy.

Answer

The USB drive hardware does not support encryption

Answer

The operating system does not support encryption of removable media

Answer

The employee used the wrong file system (FAT32 vs NTFS)

Question 6

An organization is implementing a new backup strategy for its critical servers. The backup must support rapid restoration of individual files and allow for a recovery point objective (RPO) of no more than 15 minutes. Which backup method should be used for daily operations?

Accepted Answer

Continuous data protection (CDP). Continuous data protection (CDP) is the only backup method that can guarantee a recovery point objective (RPO) of 15 minutes or less because it captures every write to disk in real time or near-real time, enabling restoration to any point within the protection window. Full, differential, and incremental backups all rely on periodic snapshots, which inherently introduce gaps that exceed a 15-minute RPO unless the interval is shorter than 15 minutes, which is impractical for daily operations.

Answer

Full backup every 24 hours

Answer

Differential backup every 6 hours

Answer

Incremental backup every 4 hours

Question 7

During a vulnerability scan, a security analyst discovers that a web server is running an outdated version of Apache with known remote code execution vulnerabilities. The server is in production and cannot be patched immediately due to dependency conflicts. What is the best compensating control to reduce risk while a permanent fix is developed?

Accepted Answer

Implement a web application firewall (WAF) to block known attack patterns. A Web Application Firewall (WAF) is the best compensating control because it can inspect HTTP/HTTPS traffic at the application layer (Layer 7) and block known attack patterns targeting the outdated Apache version, such as specific payloads for CVE-2017-9798 or CVE-2021-41773. Unlike other options, a WAF provides virtual patching without modifying the vulnerable server, directly mitigating the remote code execution risk while a permanent fix is developed.

Answer

Disable all unnecessary modules and services on the server

Answer

Enable detailed logging and alerting for the server

Answer

Isolate the server in a separate VLAN with strict ACLs

Question 8

Which TWO of the following are essential components of a successful security awareness program?

Accepted Answer

Metrics to measure the program's effectiveness. Metrics to measure the program's effectiveness (Option A) are essential because they provide quantifiable data—such as phishing click rates, incident reporting trends, and policy violation statistics—that allow the organization to evaluate whether the awareness program is changing behavior and reducing risk. Without metrics, the program cannot be improved or justified to stakeholders, making it a core component of a successful security awareness initiative.

Answer

Implementation of technical controls like antivirus

Answer

Annual one-time training sessions

Answer

Punitive measures for security violations

Question 9

Which THREE of the following are best practices for securing a data center's physical access?

Accepted Answer

Implement multi-factor authentication at entry points. Multi-factor authentication (MFA) at entry points combines two or more independent credentials (e.g., smart card and PIN, or biometric and token) to verify identity. This significantly reduces the risk of unauthorized access because compromising a single factor (e.g., a lost card) is insufficient to gain entry. MFA aligns with the defense-in-depth principle and is a core physical security control for sensitive areas.

Answer

Use only biometric readers for all doors

Answer

Allow visitors to access the lobby without an escort

Question 10

Which TWO of the following are valid reasons for conducting a business impact analysis (BIA)?

Accepted Answer

To identify critical business processes and their dependencies. Option D is correct because a Business Impact Analysis (BIA) is specifically designed to identify critical business processes and their dependencies on resources such as personnel, systems, and data. This identification is foundational for prioritizing recovery strategies in business continuity planning, as it directly links operational needs to technical infrastructure.

Answer

To identify vulnerabilities in the network infrastructure

Answer

To perform a full security audit of the organization

Answer

To create a list of all hardware and software assets

Question 11

A network administrator finds the above log entry. The source IP 192.168.1.10 is a user workstation. What does this log entry indicate?

Accepted Answer

The workstation attempted to access a web server on the internet and the traffic was blocked by an inbound ACL. Option C is correct because the log entry shows a packet from source IP 192.168.1.10 (the workstation) to a destination IP on the internet with destination port 80 (HTTP), and the action taken by the firewall is 'denied' by an inbound ACL. In firewall terminology, an inbound ACL filters traffic entering an interface; here, the return traffic from the web server to the workstation is being blocked by the inbound ACL on the external interface, meaning the workstation's outbound request was allowed but the response was denied, indicating the workstation attempted to access a web server but the traffic was blocked.

Answer

An external host attempted to connect to the workstation on port 80

Answer

The firewall detected an intrusion attempt from the workstation

Answer

The workstation successfully connected to a web server on the internet

Question 12

An AWS security engineer is reviewing the above S3 bucket policy. What is the net effect of this policy on requests to read objects in the 'confidential' folder?

Accepted Answer

Only IPs in 10.100.0.0/16 can read confidential objects. The S3 bucket policy grants read access to the 'confidential' folder for all principals within the 10.0.0.0/8 IP range, but then explicitly denies access to IPs within the 10.100.0.0/16 subnet. Because explicit Deny overrides any Allow, the net effect is that only IPs in 10.0.0.0/8 that are NOT in 10.100.0.0/16 can read objects. This matches option D.

Answer

Only IPs in 10.0.0.0/8 but outside 10.100.0.0/16 can read confidential objects

Answer

No IPs can read confidential objects because the Deny applies to all

Answer

All IPs in the 10.0.0.0/8 range can read confidential objects

Question 13

You are a security analyst at a financial institution. The company has a hybrid infrastructure with on-premises servers and AWS cloud. The on-premises network uses a SIEM that aggregates logs from all sources. Recently, the SIEM has been generating a high volume of alerts for failed SSH login attempts from an internal IP (10.10.50.100) to multiple Linux servers. The IP belongs to a jump box used by system administrators. Upon investigation, you find that the jump box is running a hardened OS, and only authorized admins can access it via SSH key authentication. However, the failed login attempts show usernames like 'root', 'admin', 'test', which are not valid accounts on the target servers. The attempts occur every 5 seconds around the clock. There are no successful logins from that IP. The jump box has the latest patches and antivirus. What should you do FIRST?

Accepted Answer

Isolate the jump box from the network immediately and conduct a forensic analysis. The jump box is exhibiting automated, high-frequency failed login attempts with non-existent usernames, which is a classic indicator of a compromised host being used as an attack launch point—even if the OS appears hardened and AV shows clean. The first priority in incident response is containment; isolating the jump box prevents further potential lateral movement or data exfiltration while preserving forensic evidence. A forensic analysis is then required to determine the root cause (e.g., a hidden backdoor, credential theft, or kernel-level rootkit) before any remediation steps.

Answer

Add the usernames 'root', 'admin', 'test' to the target servers' password blacklist

Answer

Ignore the alerts because the usernames are invalid and the jump box is hardened

Answer

Run a full antivirus scan on the jump box and check for malware

Question 14

Drag and drop the steps for implementing mandatory access control (MAC) in a secure system in the correct order.

Question 15

Match each business continuity term to its definition.