CISSP Security Operations 4 — Questions and Answers
Question 1: What is the PRIMARY objective of conducting a lessons-learned review after an incident has been resolved?
- Determining liability and assigning blame to responsible parties
- Improving processes and controls to prevent recurrence (Correct answer)
- Satisfying regulatory reporting requirements
- Calculating the financial impact for insurance claims
Correct answer: Improving processes and controls to prevent recurrence
Lessons-learned reviews identify gaps in detection, response, and prevention so that controls and procedures can be improved before the next incident.
Question 2: An administrator sets an account lockout policy that triggers after 5 failed login attempts within 10 minutes. Which attack does this PRIMARILY mitigate?
- Pass-the-hash attack
- Online brute-force attack (Correct answer)
- Rainbow table attack
- Credential stuffing from a breached database
Correct answer: Online brute-force attack
Account lockout thresholds stop online brute-force attacks by locking the account after a defined number of consecutive failed attempts.
Question 3: Which data destruction method is MOST appropriate for ensuring that sensitive data on a solid-state drive (SSD) cannot be recovered?
- Degaussing
- Single-pass overwrite
- Cryptographic erasure followed by physical destruction (Correct answer)
- Reformatting the drive
Correct answer: Cryptographic erasure followed by physical destruction
SSDs use wear leveling that prevents reliable overwriting; cryptographic erasure destroys the encryption key, and physical destruction eliminates any remaining data.
Question 4: A SOC analyst observes repeated DNS queries from an internal host to randomly generated domain names at regular intervals. Which attack technique does this MOST likely indicate?
- DNS cache poisoning
- Domain generation algorithm (DGA) based C2 communication (Correct answer)
- DNS amplification DDoS
- BGP hijacking
Correct answer: Domain generation algorithm (DGA) based C2 communication
Malware using a Domain Generation Algorithm (DGA) generates many pseudo-random domain names and queries them to locate an active command-and-control server.
Question 5: Which physical security control uses two interlocking doors where the first must close before the second opens, preventing tailgating?
- Turnstile
- Mantrap (airlock) (Correct answer)
- Bollard
- Motion sensor
Correct answer: Mantrap (airlock)
A mantrap is a small room with two controlled doors that requires authentication and ensures only one person enters at a time, preventing tailgating.
Question 6: What is the key distinction between a warm site and a hot site in business continuity planning?
- A warm site has no infrastructure; a hot site has full infrastructure
- A warm site has hardware but requires time to restore data; a hot site is fully operational and can assume production immediately (Correct answer)
- A warm site is off-site; a hot site is on-site
- A warm site uses tape backups; a hot site uses cloud replication
Correct answer: A warm site has hardware but requires time to restore data; a hot site is fully operational and can assume production immediately
A hot site mirrors production in real time and can take over immediately, while a warm site has hardware ready but needs backup restoration before it can operate.
Question 7: When performing vulnerability scanning in an operational environment, which approach minimizes risk to production system availability?
- Running credentialed scans during peak business hours for accuracy
- Conducting unauthenticated scans during off-peak hours with change management approval (Correct answer)
- Using an exploit framework to confirm vulnerabilities before reporting
- Disabling all firewalls between the scanner and targets for complete coverage
Correct answer: Conducting unauthenticated scans during off-peak hours with change management approval
Scanning during off-peak hours with change management approval reduces the chance that scan traffic disrupts production services.
CISSP Security Operations 4
What is the PRIMARY objective of conducting a lessons-learned review after an incident has been resolved?