How should I use these Security Operations practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Operations questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Operations domain.

CC · topic practice

Security Operations practice questions

Practise ISC2 Certified in Cybersecurity CC Security Operations practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Operations

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Operations

Security Operations questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security Operations exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security Operations questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Security Operations explanation →

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Trap 1: SOC Manager

The SOC Manager oversees operations, not daily triage.

Trap 2: Tier 3

Tier 3 performs advanced analysis and threat hunting.

Trap 3: Tier 2

Tier 2 conducts deeper investigation, not initial triage.

Study all Security Operations common traps →

A
SOC Manager
Why wrong: The SOC Manager oversees operations, not daily triage.
B
Tier 3
Why wrong: Tier 3 performs advanced analysis and threat hunting.
C
Tier 2
Why wrong: Tier 2 conducts deeper investigation, not initial triage.
D
Tier 1
Correct. Tier 1 handles initial alert monitoring and triage.

Security Operations practice questions

What to know about Security Operations

Common Security Operations exam traps

Security Operations questions

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

Which of the following is an indicator of a phishing email?

What is the primary purpose of using security baselines derived from CIS Benchmarks?

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

An employee receives an email from the CEO asking for an urgent wire transfer to a new vendor. The email address is slightly misspelled. What type of attack is this?

A configuration management tool detects that a critical server's security settings have changed from the approved baseline. What is the first action the security team should take?

An organization is implementing a security awareness program. Which THREE topics should be included to address common social engineering attacks? (Select THREE)

A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)

A security engineer is designing a patch management process. Which TWO steps are part of the standard patch lifecycle? (Select TWO)

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

An organization needs to retain authentication logs for compliance with PCI DSS. What is the minimum retention period required, and how long must the logs be immediately available?

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Track your progress over time

Start a Security Operations only practice session

Related CC topic practice pages

Security Principles practice questions

Business Continuity, Disaster Recovery, and Incident Response practice questions

Access Controls Concepts practice questions

Security Operations practice questions

Network Security practice questions

Business Continuity, DR & Incident Response practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid