ISC Security Operations Practice Test 3 — 15 Questions

Question 1

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

Accepted Answer

Next steps for mitigation and remediation. Executives need the business impact, the current status, and the next planned actions.

Answer

The raw packet captures of the attack

Answer

The specific login credentials used

Question 2

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Accepted Answer

Dedicated bridge line (conference call). A dedicated bridge line (conference call) is correct because it provides a real-time, always-available voice channel that lets incident responders, management, and stakeholders coordinate synchronously during an active emergency without depending on compromised systems. Encrypted out-of-band messaging such as Signal is correct because it uses a separate, end-to-end encrypted channel outside the potentially breached corporate network, preserving confidentiality and availability if primary infrastructure is down or untrusted. Public social media feeds do not belong because they are unauthenticated, unencrypted, and publicly visible, making them unsuitable for sensitive incident coordination. Internal corporate email does not belong because it is often the compromised or monitored channel and is asynchronous, so it cannot be trusted or relied upon during an emergency. The company-wide intranet homepage does not belong because it is a one-way broadcast medium hosted on internal infrastructure that may itself be unavailable or compromised during an incident.

Answer

Public social media feeds

Answer

Internal corporate email

Answer

Company-wide intranet homepage

Question 3

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

Accepted Answer

Authentication/Identity logs. A robust SIEM needs endpoint logs, network logs, and identity/access logs to correlate threats.

Answer

Building HVAC monitoring logs

Answer

Office breakroom temperature logs

Question 4

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

Known Command and Control (C2) IP address. Option B is correct because a known Command and Control (C2) IP address is a classic network-based IOC: it is an observable artifact (an IP address) that indicates communication with attacker infrastructure, and it can be used in SIEM rules, firewalls, or IDS/IPS signatures to detect or block malicious traffic. Option C is correct because a malicious file hash (e.g., SHA-256) is a host/file-based IOC: the cryptographic hash uniquely identifies a known malicious file and can be searched for across endpoints, sandboxes, and threat-intelligence feeds to detect the same malware without needing to inspect the file contents. The other options are not IOC types: A (employee performance review) and D (company fiscal year budget) are internal business/HR documents with no security-observable artifact value, and E (new printer firmware update) is a legitimate maintenance activity rather than an indicator of compromise, though a malicious firmware update could theoretically be an attack vector, the option as written describes a normal update, not an IOC.

Answer

Employee performance review

Answer

Company fiscal year budget

Answer

New printer firmware update

Question 5

Which THREE technical controls are effective for limiting the impact of lateral movement?

Accepted Answer

Network micro-segmentation. Network micro-segmentation (C) is correct because it divides the network into granular zones with strict east-west firewall/ACL policies, so a compromised host cannot freely reach other internal systems, directly containing lateral movement. Removing local administrative privileges (D) is correct because it enforces least privilege, preventing attackers from using stolen credentials to perform pass-the-hash, remote service creation, or admin-share access (e.g., C$, ADMIN$) on other hosts. Enforced MFA (E) is correct because it blocks lateral movement that relies on compromised passwords or NTLM hashes for interactive/RDP/remote logons, since a second factor is required and stolen credentials alone are insufficient. Increasing external bandwidth (A) is unrelated to containment—it only affects throughput for external traffic and does nothing to stop internal pivoting. Public domain name registration (B) is an administrative/branding function with no bearing on restricting attacker movement inside the environment.

Answer

Increasing external bandwidth

Answer

Public domain name registration

Question 6

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

Accepted Answer

Conducting incident drills and exercises. Preparation involves setting up tools, training the team, and defining the procedures necessary for effective response.

Answer

Eradicating an ongoing malware infection

Answer

Writing the post-incident summary report

Question 7

A security manager at a mid-sized financial firm discovers that a privileged database administrator account was used at 02:00 UTC to export 40 GB of customer records to an external IP address. The account was not locked out, no alert fired, and the export completed over 47 minutes. Which action should the manager take FIRST to align with the ISC2 ISSMP incident management lifecycle?

Accepted Answer

Trigger the containment phase by disabling the account and blocking the destination IP at the perimeter firewall.. The incident management lifecycle requires that once a compromise is confirmed, containment precedes eradication, recovery, and lessons learned. Disabling the privileged account and blocking the destination endpoint halts active data loss while preserving evidence. Reimaging, reviewing lessons learned, or notifying regulators before containment would allow the exfiltration to continue and could destroy forensic artifacts needed for scoping.

Answer

Notify the board and external regulators immediately before taking any technical action.

Answer

Initiate the lessons-learned review to determine why no SIEM alert fired for the large export.

Answer

Begin the eradication phase by reimaging the database server and resetting all domain credentials.

Question 8

A healthcare organization is building a Security Operations Center and must define how it will measure and govern detection and response performance. The CISO asks the security manager to select metrics that directly reflect the SOC's ability to detect and respond to threats. Which TWO metrics best meet this requirement? (Choose two.)

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect and mean time to respond directly quantify the SOC's detection and response capabilities. MTTD exposes how quickly monitoring and correlation identify malicious activity, while MTTR shows how efficiently the team contains and resolves confirmed incidents. Training counts, attestation rates, and firewall review counts measure program activity or compliance rather than operational SOC performance.

Answer

Percentage of employees who completed annual security policy attestation

Answer

Number of security awareness training sessions delivered per quarter

Answer

Total number of firewall rules reviewed during the quarter

Question 9

A security manager is drafting the business continuity plan for a payment processing platform. The CIO asks which element establishes the maximum tolerable time that the payment service can be unavailable before the organization suffers unacceptable financial and regulatory harm. Which concept should the manager document?

Accepted Answer

Maximum tolerable downtime (MTD). Maximum tolerable downtime defines the longest a business process can be unavailable before the impact becomes unacceptable. The recovery time objective is then set within that limit, and the recovery point objective governs acceptable data loss. An SLA uptime figure is contractual, and RTO and RPO are subordinate targets, so MTD is the concept that answers the CIO's question.

Answer

Service level agreement (SLA) uptime percentage

Answer

Recovery point objective (RPO)

Answer

Recovery time objective (RTO)

Question 10

During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?

Accepted Answer

Capture a full physical memory image using LiME, record running processes with ps aux, and save network connection state from /proc/net, then proceed with the rebuild.. Volatile evidence such as RAM contents, running processes, and network connections is lost the instant a system is powered off or rebuilt. Capturing these artifacts first with a tool like LiME preserves the most perishable and often most probative evidence. Because the acquisition can be performed quickly, the 30-minute rebuild window remains achievable, balancing forensic obligations with the availability requirement of the billing application.

Answer

Power off the server immediately and remove the disk drives for forensic imaging at the lab, accepting the extended downtime as necessary for evidence integrity.

Answer

Run a full antivirus scan and collect the resulting quarantine log, then rebuild the server once the scan confirms the malware has been removed.

Answer

Take a forensic snapshot of the virtual machine through the hypervisor management console and continue running the production workload on the original VM.

Question 11

A security manager is reviewing the organization's log management program. An auditor notes that several critical servers retain logs for only 7 days, while the incident response policy requires the ability to investigate incidents up to 90 days after detection. The servers generate approximately 50 GB of logs per day. Which action BEST addresses the audit finding while controlling storage cost?

Accepted Answer

Configure a centralized log management platform to ingest the server logs, retain full-fidelity data for 90 days, and store compressed archives for a longer period on lower-cost storage.. The audit finding requires the ability to investigate incidents up to 90 days after detection, which means logs must be retained, protected from tampering, and searchable for that period. A centralized platform with tiered retention satisfies the requirement by keeping recent data readily searchable while archiving older data on cheaper storage. This balances investigative needs with storage cost at 50 GB per day.

Answer

Reduce the logging level on the servers so that only error events are recorded, allowing 90 days of retention within the existing local disk capacity.

Answer

Increase the local log rotation on each server to keep 90 days of logs on the server's own disk, expanding storage as needed on each host.

Answer

Enable log forwarding to a syslog server with default retention settings and rely on the syslog server's built-in compression to meet the 90-day requirement.

Question 12

A security manager is building the incident response program for a financial services firm and needs to define the criteria that determine when an event must be escalated to a formally declared incident. Which artifact should be created to document these criteria, the required responders, and the approval chain for escalation?

Accepted Answer

Incident response plan (IRP). Defining when an event becomes a declared incident, who must respond, and who approves escalation is the core purpose of the incident response plan. It provides the classification thresholds and authority structure that guide the SOC's triage decisions and ensures consistent, accountable escalation across the organization.

Answer

Business continuity plan (BCP)

Answer

Service level agreement (SLA)

Answer

Disaster recovery plan (DRP)

Question 13

A security operations manager is reviewing the SOC's use of threat intelligence and wants to ensure that indicators are automatically ingested and matched against event data with minimal latency. Which capability should be prioritized to meet this objective?

Accepted Answer

Automated threat intelligence platform integration with the SIEM using structured formats. Automated integration between a threat intelligence platform and the SIEM using structured formats like STIX/TAXII allows indicators to be ingested and matched against event data continuously with minimal delay. This is the mechanism that turns threat intelligence into actionable detections in near-real time.

Answer

Quarterly distribution of a PDF threat report to SOC analysts

Answer

Manual review of intelligence reports by senior analysts before ingestion

Answer

Manual entry of indicators into a spreadsheet shared by the team

Question 14

A security manager is establishing a formal incident response capability and wants to ensure that lessons learned from major incidents are captured and used to improve future response. Which activity should be conducted after a significant incident to meet this goal?

Accepted Answer

A post-incident review (lessons learned) meeting. Conducting a post-incident review after significant incidents is the recognized practice for capturing lessons learned. It examines response actions, identifies gaps in plans and coordination, and produces recommendations that update the incident response plan, training, and tooling, thereby improving future response.

Answer

A vulnerability scan of the affected environment

Answer

A business impact analysis (BIA)

Answer

A penetration test of the production network

Question 15

A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?

Accepted Answer

Disconnect the file server's network cable and leave the system powered on to preserve volatile memory and active encryption state.. Containment must stop the spread immediately without destroying evidence. Physically disconnecting the network cable isolates the host while keeping memory and running processes available for forensic analysis. Powering off destroys volatile evidence, scanning in place allows continued encryption, and network-layer tricks are too slow. The manager should authorize the physical disconnection as the fastest, evidence-preserving containment step.

Answer

Immediately power off the file server to halt encryption and prevent further data loss.

Answer

Revoke the file server's DNS registration and wait for DHCP lease expiration to remove it from the network.

Answer

Run a full antivirus scan on the file server and quarantine any detected malware while keeping it on the network.