CISSP Security Operations Practice Test 4 — 15 Questions

Question 1

A security analyst notices that the SIEM is generating an overwhelming number of low-priority alerts from a single application server. The server is critical to operations. What is the BEST approach to reduce noise without compromising security?

Accepted Answer

Create a suppression rule for known benign patterns.. Option C is correct because suppression rules allow the SIEM to filter out known benign patterns (e.g., routine service checks or scheduled scans) while still capturing genuine threats. This reduces alert fatigue without disabling monitoring for the critical server, preserving visibility into anomalous or malicious activity.

Answer

Increase the severity threshold for that server's alerts.

Answer

Disable all alerts from that server.

Answer

Exclude the server from SIEM monitoring.

Question 2

Which of the following is a key requirement for an effective backup strategy to ensure data can be recovered after a ransomware attack?

Accepted Answer

Backups are encrypted and stored offline or air-gapped.. Option B is correct because backups that are encrypted and stored offline or air-gapped are protected from encryption by ransomware. Other options would leave backups vulnerable.

Answer

Incremental backups are performed monthly.

Answer

Backups use the same credentials as the production environment.

Answer

Backups are stored on the same network as production.

Question 3

During an incident response, the team identifies that the attacker gained access through a compromised service account with domain admin privileges. Which of the following steps should be taken FIRST to contain the incident?

Accepted Answer

Disable the compromised account and revoke its tokens.. Disabling the compromised account and revoking its tokens (e.g., Kerberos TGTs via `Set-ADAccountControl -Disable` and clearing cached tickets) immediately stops the attacker's current authentication and lateral movement capabilities. This is the fastest containment step because the service account with Domain Admin privileges is the direct vector; isolating systems or resetting all passwords is slower and may not address active token reuse.

Answer

Isolate all affected systems from the network.

Answer

Reset all user passwords.

Answer

Perform a full forensic analysis before any action.

Question 4

A company is deploying a new web application and needs to ensure that only HTTPS traffic is allowed. What is the MOST effective way to enforce this at the network perimeter?

Accepted Answer

Allow TCP port 443 only and block port 80.. Blocking TCP port 80 and allowing only TCP port 443 at the network perimeter ensures that only HTTPS traffic can enter or leave the network. This is the most effective method because it directly enforces the protocol restriction at the firewall, preventing any HTTP traffic from bypassing encryption. Allowing both ports would permit unencrypted HTTP, while using a proxy or blocking port 443 would either add unnecessary complexity or deny legitimate HTTPS traffic.

Answer

Configure the firewall to allow TCP port 80 and 443.

Answer

Use a proxy server to decrypt all traffic.

Answer

Block TCP port 443.

Question 5

Which of the following is a primary purpose of conducting a tabletop exercise for incident response?

Accepted Answer

Validate communication and decision-making processes.. A tabletop exercise is a discussion-based session where participants walk through a simulated incident scenario to evaluate the effectiveness of communication channels, decision-making hierarchies, and coordination among stakeholders. It does not involve live systems or technical testing, so its primary purpose is to validate the procedural and human elements of the incident response plan, such as who notifies whom and how escalation decisions are made.

Answer

Measure the effectiveness of backup restoration.

Answer

Test technical capabilities of security tools.

Answer

Identify unpatched vulnerabilities in systems.

Question 6

A security team is evaluating a new endpoint detection and response (EDR) solution. Which of the following capabilities is MOST important for detecting fileless malware?

Accepted Answer

Behavioral analysis and process monitoring.. Option B is correct because behavioral analysis and process monitoring detect anomalous behavior typical of fileless malware. Signature-based detection is ineffective against fileless variants.

Answer

Static malware analysis.

Answer

Signature-based detection.

Answer

Network traffic inspection.

Question 7

An organization is required to retain audit logs for seven years due to regulatory compliance. The logs are currently stored on a file server that is approaching capacity. What is the BEST way to manage log storage?

Accepted Answer

Compress logs and move them to low-cost archival storage.. Option D is correct because it balances the seven-year retention requirement with storage constraints by compressing logs (reducing size) and moving them to low-cost archival storage (e.g., cold storage or tape). This preserves data integrity and accessibility for compliance audits while freeing up space on the primary file server.

Answer

Reduce the logging level to generate less data.

Answer

Delete logs older than one year.

Answer

Increase the frequency of log rotation.

Question 8

Which of the following is a best practice for managing privileged user accounts?

Accepted Answer

Use separate administrative accounts for non-privileged tasks.. Option B is correct because the principle of least privilege dictates that administrative accounts should only be used for privileged tasks, not for routine activities like email or web browsing. Using separate, non-privileged accounts for daily work reduces the risk of credential theft and limits the attack surface if a user's session is compromised. This practice is a core component of privileged access management (PAM) and aligns with NIST SP 800-53 AC-6.

Answer

All users should be granted admin rights by default.

Answer

Passwords for privileged accounts should never be changed.

Answer

Shared generic accounts should be used to avoid multiple credentials.

Question 9

During a forensic investigation, the team needs to preserve evidence from a running server. What is the FIRST step the team should take?

Accepted Answer

Capture a memory dump.. The first step in a forensic investigation of a running server is to capture a memory dump because volatile data (RAM) contains critical evidence such as running processes, network connections, encryption keys, and malware that would be lost if the system is powered off or altered. Preserving this volatile state before any other action ensures that the most transient evidence is secured, following the order of volatility principle. Capturing memory first prevents irreversible loss of data that cannot be recovered from disk or network captures.

Answer

Create a disk image.

Answer

Shut down the server normally.

Answer

Unplug the network cable.

Question 10

Which TWO of the following are essential components of a disaster recovery plan? (Choose two.)

Accepted Answer

Recovery Point Objective (RPO). Options A and C are correct. Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are key metrics. Business continuity plan is a separate but related plan; cold sites and SLAs are not components of a DRP itself.

Answer

Business continuity plan

Answer

Service Level Agreement (SLA)

Answer

Cold site configuration

Question 11

Which TWO of the following are effective methods for detecting unauthorized access to a network? (Choose two.)

Accepted Answer

Security information and event management (SIEM). A SIEM aggregates and correlates logs from multiple sources (e.g., firewalls, servers, IDS) in real time, enabling detection of anomalous patterns indicative of unauthorized access. It provides centralized visibility and alerting that can identify a breach even when individual logs appear benign.

Answer

Vulnerability scanner

Answer

Antivirus software

Answer

Firewall rule review

Question 12

Which THREE of the following are common indicators of a privilege escalation attack? (Choose three.)

Accepted Answer

Creation of new user accounts with administrative privileges. Option A is correct because the creation of new user accounts with administrative privileges is a classic post-exploitation technique used by attackers to establish persistent elevated access. After successfully exploiting a vulnerability to gain initial elevated privileges, an attacker often creates a backdoor account (e.g., via `net user /add` and `net localgroup Administrators /add` on Windows, or `useradd -G wheel` on Linux) to maintain control even if the original exploit vector is patched. This indicator is directly tied to privilege escalation as it demonstrates an unauthorized elevation from a lower-privileged context to full administrative control.

Answer

Higher-than-normal network traffic

Answer

System performance degradation

Question 13

Based on the firewall log entry, what is the most likely reason the connection was denied?

Accepted Answer

The outbound connection was blocked by an access control list.. The firewall log entry shows an outbound connection attempt from source IP 10.0.0.5:54321 to destination IP 203.0.113.50:80 that was denied. Firewalls typically evaluate outbound traffic against access control lists (ACLs) before any deeper inspection. Since the log does not indicate any signature match or blacklist hit, the most straightforward reason is that an ACL rule explicitly blocked this outbound connection.

Answer

The connection was denied due to malicious signature detection.

Answer

The destination IP address is blacklisted.

Answer

The source port 54321 is a prohibited port.

Question 14

Based on the log entry from an authentication server, which immediate action should the security team take to reduce risk?

Accepted Answer

Disable root login via SSH.. The log entry shows repeated failed SSH authentication attempts as root from an internal IP (10.0.0.5). Disabling root login via SSH (Option C) directly eliminates the ability to authenticate as the root user over SSH, which is a fundamental security best practice per CISSP and industry standards (e.g., CIS benchmarks). This reduces the risk of brute-force attacks targeting the root account, as an attacker would need to guess both a valid username and password instead of targeting a known privileged account.

Answer

Block the source IP 10.0.0.5 in the firewall.

Answer

Change the SSH port to a non-standard port.

Answer

Increase the logging verbosity for SSH.

Question 15

An organization with 500 employees operates a hybrid infrastructure with on-premises Active Directory and cloud-based services (Office 365, Azure). The security team receives an alert from the SIEM showing a high number of failed login attempts for a service account named 'svc_backup' from an external IP address. The account has delegated permissions to back up all domain controllers. The attempts are ongoing and fall below the lockout threshold to avoid detection. The team suspects a targeted password spraying attack. The helpdesk reports no recent password changes for this account. The incident response plan requires containment within 15 minutes. The cloud services are integrated with AD via Azure AD Connect. Which of the following actions BEST contains the attack while minimizing operational impact?

Accepted Answer

Disable the svc_backup account in Active Directory and notify the backup team to use an alternate account.. Option C is correct because disabling the compromised service account in Active Directory immediately stops the ongoing password spraying attack, preventing further unauthorized access attempts. This action contains the threat within the 15-minute containment window while minimizing operational impact, as the backup team can switch to an alternate account without disrupting critical backup operations. Disabling the account is faster and more reliable than changing the password, which might not propagate immediately to all domain controllers and cloud services via Azure AD Connect.

Answer

Block the external IP address at the firewall.

Answer

Configure Azure AD Conditional Access to require MFA for the account.

Answer

Immediately change the password of the svc_backup account.