(ISC)² CISSP Security Operations Practice Questions

Free CISSP Security Operations practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main (ISC)² CISSP page. Sign up free to practice the full set.

1. Question 1Security Operations

   What is the correct high-level incident response order (NIST)?

   • ADetection & Analysis → Recovery tasks → Preparation steps → Eradication → Post-Incident Activity
   • BPreparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident ActivityCorrect
   • CContainment → Recovery tasks → Preparation steps → Detection & Analysis → Post-Incident Activity
   • DRecovery tasks → Preparation steps → Detection & Analysis → Containment → Post-Incident Activity
   ✓ Correct answer: B

   The NIST SP 800-61 incident response lifecycle begins with Preparation, moves to Detection & Analysis when an event is identified, then Containment, Eradication & Recovery to stop, remove, and restore, and finally Post-Incident Activity to capture lessons learned. Preparation must come first because response capability has to exist before an incident occurs, and post-incident review closes the loop by feeding improvements back into preparation.

   Why the other options are wrong

   • ARecovery cannot precede Preparation, and detection is not the first phase; the lifecycle must start with Preparation.
   • CContainment cannot occur before an incident is detected, so starting with Containment is out of order.
   • DRecovery cannot come before Preparation or Detection; restoring occurs after an incident is identified and contained.
2. Question 2Security Operations

   During digital forensics, which order should evidence be collected in to preserve the most volatile data first?

   • AImage the disk first, then power the system off, then attempt to capture RAM afterward
   • BCollect evidence in whatever order is fastest, since volatility does not affect it at all
   • CStart with backup tapes, then disk, then network state, then RAM, then CPU cache last
   • DCPU registers/cache, then RAM, then network state, then disk, then archival mediaCorrect
   ✓ Correct answer: D

   Digital forensics follows the order of volatility: data that changes fastest must be captured first, before it degrades or is overwritten. CPU registers and cache change in nanoseconds, RAM contents can be lost on power loss or process activity, network state changes continuously, and disk and archival media remain comparatively stable. Capturing in that sequence preserves the most fragile evidence, supports an accurate timeline, and protects the chain of custody needed for admissibility.

   Why the other options are wrong

   • APowering off after imaging the disk destroys volatile RAM before it can be captured.
   • BVolatility is central to forensic order; the most volatile data must be captured first.
   • CThis runs the order backwards, starting with the least volatile archival media.
3. Question 3Security Operations

   What does EDR (Endpoint Detection and Response) provide that traditional signature-only antivirus does not?

   • AContinuous endpoint telemetry, behavioral detection, and investigation/response capabilitiesCorrect
   • BA static list of known virus hashes with no ongoing endpoint telemetry collection
   • CFull-disk encryption enforced on every managed endpoint device in the fleet
   • DNetwork segmentation maintained between endpoints and internal servers
   ✓ Correct answer: A

   Traditional antivirus relies on matching files against a static database of known malware signatures, so it misses novel or fileless attacks that do not match a known hash. EDR instead continuously collects telemetry from every endpoint, such as process activity, network connections, and registry changes, and applies behavioral analysis to detect suspicious patterns even from previously unseen threats. It also gives responders the tools to investigate an alert in context and take action, like isolating a host or killing a process, directly from the console.

   Why the other options are wrong

   • BA signature-only hash list is precisely the legacy approach EDR improves upon.
   • CDisk encryption protects data at rest and is not what EDR provides.
   • DSegmentation is a network control, separate from EDR's endpoint telemetry and response.
4. Question 4Security Operations

   A data loss prevention (DLP) system inspects outbound email and blocks messages containing patterns that match credit card numbers. Which type of DLP deployment is this?

   • AEndpoint (host-based) DLP
   • BNetwork (in-transit) DLPCorrect
   • CStorage (data-at-rest) DLP
   • DCloud access security broker discovery
   ✓ Correct answer: B

   Network DLP monitors data in transit at egress points like mail gateways and web proxies, applying content inspection to detect and stop sensitive data from leaving. Blocking outbound email that matches cardholder-data patterns is a classic network DLP function.

   Why the other options are wrong

   • AEndpoint DLP runs an agent on the device to control actions like copying to USB or printing, not gateway email inspection.
   • CStorage DLP scans data at rest in repositories to find sensitive content, not data traversing the network.
   • DA CASB focuses on visibility and control over cloud service usage, not inspecting outbound corporate email at the mail gateway.
5. Question 5Security Operations

   During litigation, an organization receives instruction to suspend the routine deletion of certain records and emails that may be relevant. What is this requirement called?

   • AFormal data classification labeling
   • BA legal hold (litigation hold)Correct
   • CA formal chain of custody record
   • DA formal data minimization policy
   ✓ Correct answer: B

   When litigation is reasonably anticipated, a legal (litigation) hold overrides standard retention and disposal schedules to preserve potentially relevant electronically stored information. Failing to honor it can lead to spoliation sanctions. The hold remains until the legal matter is resolved and counsel releases it.

   Why the other options are wrong

   • AData classification labels information by sensitivity; it does not suspend deletion for litigation.
   • CChain of custody documents who handled evidence; it does not by itself halt routine deletion.
   • DData minimization seeks to retain less data, the opposite of preserving it for a hold.
6. Question 6Security OperationsSelect all that apply

   A business continuity team is selecting recovery strategies and wants options that minimize recovery time for the most critical applications. Which TWO strategies provide rapid failover with near-current data? (Choose TWO)

   • AMaintaining a hot site with synchronously replicated dataCorrect
   • BUsing an active-active configuration across geographically separate data centersCorrect
   • CRelying on weekly full backups shipped to offsite tape storage
   • DContracting a cold site that requires equipment to be procured after a disaster
   ✓ Correct answer: A, B

   A hot site keeps systems running and synchronously replicated, so it can take over almost immediately with near-zero data loss. An active-active configuration runs production in multiple sites simultaneously, so the loss of one site is absorbed with negligible downtime. Both achieve very low RTO and RPO for critical applications.

   Why the other options are wrong

   • CWeekly offsite tape backups have a large recovery point (up to a week of data loss) and slow restoration, the opposite of rapid failover.
   • DA cold site requires procuring and configuring equipment after a disaster, producing the longest recovery time.
7. Question 7Security Operations

   A security team deploys a system that appears to be a vulnerable internal database server but contains no production data and is heavily instrumented to record all interactions. What is this system called?

   • AA honeypotCorrect
   • BA bastion host
   • CA jump server
   • DA reverse proxy
   ✓ Correct answer: A

   Honeypots have no legitimate production use, so any interaction with them is inherently suspicious and likely malicious. They let defenders detect intrusions early, observe attacker techniques, and divert effort away from real assets. Their value lies in producing high-fidelity alerts with very low false-positive rates.

   Why the other options are wrong

   • BA bastion host is a hardened, exposed system providing real services; it is not a decoy.
   • CA jump server is an administrative gateway used to reach internal systems, not a trap.
   • DA reverse proxy forwards client requests to back-end servers and is a legitimate production component.
8. Question 8Security Operations

   An organization wants to ensure that no single administrator can both initiate and approve a privileged change to a financial system. Which principle most directly enforces this control?

   • ASeparation of dutiesCorrect
   • BLeast privilege
   • CNeed to know
   • DDefense in depth
   ✓ Correct answer: A

   By requiring different individuals to initiate and approve a change, separation of duties prevents fraud and error that a single actor could otherwise commit unchecked. It is a cornerstone control for high-risk processes.

   Why the other options are wrong

   • BLeast privilege limits each user to the minimum access needed but does not by itself split a process across people.
   • CNeed to know restricts access to information based on job requirement, not the division of a transaction.
   • DDefense in depth layers multiple controls; it is a broad strategy, not this specific division of duties.

How Security Operations is tested

This domain holds 157 of the 1,117 questions in the CISSP bank, about 14%. The mix is 129 single-answer multiple choice and 28 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Operations on its own rather than re-running full-length mocks.

Other CISSP exam domains

• Security and Risk Management172 questions
• Asset Security109 questions
• Security Architecture and Engineering141 questions
• Communication and Network Security138 questions
• Identity and Access Management138 questions
• Security Assessment and Testing130 questions
• Software Development Security132 questions
• All CISSP practice questions1,117 total
• Security Operations study notesKey concepts
• Security practice examsAll Security

CISSP Security Operations FAQ