Security Operations Flashcards
7 cards from real CISSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Security Operations flashcards as text
Which type of fire suppression system discharges agent only in the zone where heat is detected, minimizing damage to surrounding equipment?
Answer: Pre-action sprinkler
A pre-action system requires two triggers (heat detector AND sprinkler head activation) before water is released, limiting discharge to the affected zone.
An analyst notices that a privileged account logged in at 2 AM and exported 10,000 records from a customer database. Which response action should be taken FIRST?
Answer: Immediately disable the account and preserve logs
Disabling the account stops ongoing harm while preserving log evidence is essential for forensic investigation.
What is the PRIMARY purpose of a Configuration Management Database (CMDB) in security operations?
Answer: Maintaining authoritative records of IT assets and their relationships
A CMDB provides a centralized, authoritative inventory of configuration items (CIs) and their interdependencies to support change and incident management.
During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive. Which tool output is used to verify the copy's integrity?
Answer: Cryptographic hash value
Comparing hash values (e.g., MD5 or SHA-256) of the original and the copy confirms that no data was altered during the imaging process.
Which patch management concept describes the maximum acceptable time between vulnerability disclosure and patch deployment?
Answer: Remediation SLA
A remediation SLA defines the contractually or policy-mandated deadline for applying patches based on vulnerability severity.
A security team wants to detect lateral movement by an attacker who has already compromised an internal workstation. Which control is MOST effective?
Answer: Network segmentation with internal traffic monitoring
Internal segmentation limits how far an attacker can move, and monitoring east-west traffic reveals anomalous connections between segments.
What distinguishes a worm from a virus in terms of propagation?
Answer: A worm self-replicates across networks without needing a host file; a virus attaches to a host file
Worms propagate autonomously by exploiting network vulnerabilities, while viruses require a host program or file to attach to and spread.