CISSP Security Operations 3 — Questions and Answers
Question 1: Which security operations principle requires that no single individual can complete a sensitive transaction without the involvement of at least one other person?
- Least privilege
- Separation of duties (Correct answer)
- Need to know
- Job rotation
Correct answer: Separation of duties
Separation of duties splits critical tasks among multiple people so that no one person can commit fraud or error without detection.
Question 2: An organization uses a honeynet to gather threat intelligence. Which is the GREATEST risk associated with this approach?
- Honeynets generate too many false positives for analysts to review
- Attackers may use the honeynet as a pivot point to attack real systems (Correct answer)
- Honeynet data is inadmissible in court proceedings
- Honeynets require expensive proprietary hardware
Correct answer: Attackers may use the honeynet as a pivot point to attack real systems
If a honeynet is not properly isolated, a compromised decoy system can serve as a launchpad for attacks against production systems.
Question 3: What is the role of an evidence custodian in a forensic investigation?
- Conducting technical analysis of digital artifacts
- Maintaining and documenting the chain of custody for all evidence (Correct answer)
- Interviewing suspects and witnesses
- Drafting the final forensic investigation report
Correct answer: Maintaining and documenting the chain of custody for all evidence
The evidence custodian is responsible for the secure storage of evidence and ensuring the chain of custody is documented and unbroken.
Question 4: A company's BCP requires that critical systems be restored within 4 hours of a disaster. Which metric defines this requirement?
- Recovery Point Objective (RPO)
- Maximum Tolerable Downtime (MTD)
- Recovery Time Objective (RTO) (Correct answer)
- Mean Time to Repair (MTTR)
Correct answer: Recovery Time Objective (RTO)
The Recovery Time Objective (RTO) specifies the maximum acceptable duration for restoring a system or process after an outage.
Question 5: Which access control model is BEST suited for a military environment where data classification levels (Top Secret, Secret, Unclassified) govern information access?
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on data classification labels and subject clearance levels, making it ideal for environments with strict classification hierarchies.
Question 6: During an incident, a responder runs a live memory acquisition tool on a compromised server before shutting it down. Which forensic principle motivates this action?
- Volatile data in RAM is lost when the system powers off (Correct answer)
- Memory acquisition prevents log tampering by the attacker
- Live acquisition produces a legally defensible chain of custody automatically
- Running processes must be captured before file system imaging begins
Correct answer: Volatile data in RAM is lost when the system powers off
RAM contains volatile artifacts such as running processes, encryption keys, and network connections that are permanently lost upon shutdown.
Question 7: Which security operations center (SOC) tier is typically responsible for developing new detection rules and performing threat hunting?
- Tier 1 — Alert triage
- Tier 2 — Incident response
- Tier 3 — Advanced analysis and threat hunting (Correct answer)
- Tier 4 — Management and reporting
Correct answer: Tier 3 — Advanced analysis and threat hunting
Tier 3 analysts are senior specialists who proactively hunt for threats, reverse malware, and create custom detection logic based on threat intelligence.
CISSP Security Operations 3
Which security operations principle requires that no single individual can complete a sensitive transaction without the involvement of at least one other person?