ISC Security Operations Practice Test 2 — 15 Questions

Question 1

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Accepted Answer

Reduction in Mean Time to Remediate (MTTR). MTTR reduction directly reflects how quickly the SOC detects, responds to, and resolves incidents — a business-relevant outcome that executives can tie to reduced breach impact and operational resilience. It translates technical security work into a measurable improvement in risk exposure over time.

Answer

Total number of firewall rules

Answer

Disk space usage of the SIEM

Answer

Number of dropped packets per day

Question 2

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 3

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

Accepted Answer

External Connectors. External Connectors on a FortiGate firewall enable the SOC to dynamically update network objects (such as IP addresses, FQDNs, or MAC addresses) by pulling threat intelligence from external sources like STIX/TAXII feeds, malware databases, or cloud services. These connectors automatically synchronize with the external feed, ensuring that firewall policies and security profiles always use the latest threat data without manual intervention. This is a core feature of FortiGate's Security Fabric, allowing automated response to emerging threats.

Answer

DHCP Server

Answer

Traffic Shaper

Answer

Virtual Domains (VDOMs)

Question 4

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 5

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

Accepted Answer

Dynamic Asset Groups. Dynamic Asset Groups in Rapid7 InsightVM automatically include assets based on filter criteria such as tags, operating system, or vulnerability attributes, so assets can be grouped by business function (e.g., 'PCI servers', 'HR workstations') and kept current as the environment changes. This enables targeted vulnerability reporting and remediation workflows without manual list maintenance. It is the intended mechanism for business-function-based categorization.

Answer

User role

Answer

Scan template

Answer

Site configuration

Question 6

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

Accepted Answer

To update the baseline with the current file state. In Tripwire Enterprise, a Promotion action takes the current state of a monitored file and updates the baseline (the known-good reference) to match it. This is used after a legitimate change — such as a patch or approved configuration update — so that future changes are detected relative to the new, approved state.

Answer

To revert a file to its previous version

Answer

To deploy the file to all servers

Answer

To archive the file for legal hold

Question 7

In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?

Accepted Answer

Risk-based Prioritization. Risk-based Prioritization in Google Cloud Security Command Center (SCC) is the feature that assigns a risk score to each finding by factoring in the criticality of the affected asset (e.g., high, medium, low) and the severity of the finding itself. This produces a prioritized list that helps security teams focus on the most impactful issues first. It is a core capability of SCC's Enterprise tier and directly answers the need to rank findings based on asset criticality.

Answer

Security Health Analytics

Answer

Container Threat Detection

Answer

Event Threat Detection

Question 8

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Accepted Answer

Chain of Custody. The Chain of Custody document tracks the handling of evidence from discovery through to investigation.

Answer

Runbook

Answer

Lessons Learned Report

Answer

Risk Register

Question 9

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

Accepted Answer

Time Synchronization (NTP). Time synchronization via NTP ensures all security tools, servers, and network devices log events using a consistent time reference. Without synchronized clocks, correlating events across systems during timeline analysis becomes unreliable, leading to incorrect conclusions about attack sequences.

Answer

Data Normalization

Answer

Log Rotation

Answer

Access Control

Question 10

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Accepted Answer

To perform deep local configuration checks. A Windows Authentication Record in Qualys stores credentials (domain, username, password, or hash) that the scanner uses to log into the target host. Once authenticated, the scanner can read the registry, installed software, file permissions, and other local configuration details that are invisible to an unauthenticated scan — enabling deep local configuration checks.

Answer

To perform a packet capture

Answer

To deploy patches to the host

Answer

To bypass the local firewall

Question 11

Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?

Accepted Answer

Playbook. A Playbook or Runbook provides step-by-step guidance for specific, repeatable incident types.

Answer

System Architecture Diagram

Answer

Service Level Agreement

Answer

Incident Response Plan

Question 12

Which TWO of the following are primary components of an effective Incident Response (IR) program?

Accepted Answer

Incident Response Policy. An IR program requires both organizational support (Policy) and operational capability (Personnel/Training).

Answer

Software development lifecycle budget

Answer

Physical security badge access logs

Answer

Marketing strategy document

Question 13

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) (A) is essential because it measures the average elapsed time between a threat's occurrence and its detection by the SOC, directly quantifying the team's monitoring, alerting, and triage effectiveness. Mean Time to Contain (MTTC) (C) is equally essential because it measures how long it takes to isolate or stop a detected threat from spreading, reflecting the SOC's response and containment capability. Together, MTTD and MTTC are standard SOC KPIs that cover both the identification and containment phases named in the question. Total server downtime during updates (B) is an availability/patch-management metric, not a threat detection or containment measure. Number of coffee breaks taken (D) is irrelevant to security operations performance. Total number of users on the network (E) is an environmental sizing statistic, not a SOC performance metric.

Answer

Total server downtime during updates

Answer

Number of coffee breaks taken

Answer

Total number of users on the network

Question 14

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

Accepted Answer

Review the effectiveness of the response timeline. Post-mortems focus on identifying root causes, improving processes, and ensuring documentation is captured.

Answer

Discipline the analyst who missed the alert

Answer

Delete all evidence to save storage space

Question 15

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

Accepted Answer

Asset Criticality. Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.

Answer

Number of employees in the SOC

Answer

The cost of the security appliance