CISSP Security Operations 2 — Questions and Answers
Question 1: Which type of fire suppression system discharges agent only in the zone where heat is detected, minimizing damage to surrounding equipment?
- Wet pipe sprinkler
- Pre-action sprinkler (Correct answer)
- Dry pipe sprinkler
- Deluge system
Correct answer: Pre-action sprinkler
A pre-action system requires two triggers (heat detector AND sprinkler head activation) before water is released, limiting discharge to the affected zone.
Question 2: An analyst notices that a privileged account logged in at 2 AM and exported 10,000 records from a customer database. Which response action should be taken FIRST?
- Immediately disable the account and preserve logs (Correct answer)
- Notify law enforcement of the potential breach
- Restore the database from backup
- Send a password reset to the account owner
Correct answer: Immediately disable the account and preserve logs
Disabling the account stops ongoing harm while preserving log evidence is essential for forensic investigation.
Question 3: What is the PRIMARY purpose of a Configuration Management Database (CMDB) in security operations?
- Automating patch deployment across servers
- Maintaining authoritative records of IT assets and their relationships (Correct answer)
- Storing encryption keys for configuration files
- Tracking employee access requests
Correct answer: Maintaining authoritative records of IT assets and their relationships
A CMDB provides a centralized, authoritative inventory of configuration items (CIs) and their interdependencies to support change and incident management.
Question 4: During a forensic investigation, an examiner creates a bit-for-bit copy of a hard drive. Which tool output is used to verify the copy's integrity?
- Chain of custody form
- Cryptographic hash value (Correct answer)
- Write-blocker audit log
- Forensic image manifest
Correct answer: Cryptographic hash value
Comparing hash values (e.g., MD5 or SHA-256) of the original and the copy confirms that no data was altered during the imaging process.
Question 5: Which patch management concept describes the maximum acceptable time between vulnerability disclosure and patch deployment?
- Mean time to patch (MTTP)
- Patch window compliance
- Vulnerability aging threshold
- Remediation SLA (Correct answer)
Correct answer: Remediation SLA
A remediation SLA defines the contractually or policy-mandated deadline for applying patches based on vulnerability severity.
Question 6: A security team wants to detect lateral movement by an attacker who has already compromised an internal workstation. Which control is MOST effective?
- Perimeter firewall with IPS
- Network segmentation with internal traffic monitoring (Correct answer)
- Full-disk encryption on all workstations
- Multi-factor authentication at the perimeter
Correct answer: Network segmentation with internal traffic monitoring
Internal segmentation limits how far an attacker can move, and monitoring east-west traffic reveals anomalous connections between segments.
Question 7: What distinguishes a worm from a virus in terms of propagation?
- A worm requires user interaction to spread; a virus does not
- A worm self-replicates across networks without needing a host file; a virus attaches to a host file (Correct answer)
- A worm only targets mobile devices; a virus targets desktops
- A worm encrypts data; a virus deletes data
Correct answer: A worm self-replicates across networks without needing a host file; a virus attaches to a host file
Worms propagate autonomously by exploiting network vulnerabilities, while viruses require a host program or file to attach to and spread.
CISSP Security Operations 2
Which type of fire suppression system discharges agent only in the zone where heat is detected, minimizing damage to surrounding equipment?