CISSP Security Operations 5 — Questions and Answers
Question 1: Which concept in security operations describes the process of proactively searching for threats that have evaded existing security controls?
- Penetration testing
- Threat hunting (Correct answer)
- Red team exercise
- Vulnerability assessment
Correct answer: Threat hunting
Threat hunting is a proactive, human-led activity that assumes compromise has occurred and searches for attacker activity not caught by automated tools.
Question 2: A company wants to ensure that a departing system administrator cannot retain access to any systems after their last day. Which process BEST addresses this?
- Conducting an exit interview covering acceptable use policy
- Implementing an automated offboarding workflow that revokes all accounts and credentials upon HR termination (Correct answer)
- Requiring the administrator to sign a non-disclosure agreement
- Rotating shared passwords quarterly
Correct answer: Implementing an automated offboarding workflow that revokes all accounts and credentials upon HR termination
Automated offboarding tied to HR systems ensures immediate, comprehensive revocation of all access rights when an employee is terminated.
Question 3: What is the purpose of a Security Information and Event Management (SIEM) system's correlation engine?
- Encrypting log data before storage to ensure confidentiality
- Combining events from multiple sources to identify patterns that indicate a security incident (Correct answer)
- Replacing the need for endpoint detection and response (EDR) tools
- Automatically remediating detected threats without analyst intervention
Correct answer: Combining events from multiple sources to identify patterns that indicate a security incident
The correlation engine aggregates and analyzes events across disparate systems to surface attack patterns that individual log sources would not reveal alone.
Question 4: An organization stores backup tapes off-site. Which backup type copies only data that has changed since the LAST FULL backup, allowing for a two-tape restore?
- Incremental backup
- Differential backup (Correct answer)
- Snapshot backup
- Mirror backup
Correct answer: Differential backup
A differential backup captures all changes since the last full backup, so restoration requires only the most recent full backup and the latest differential tape.
Question 5: Which principle ensures that security controls protect information at the level of its classification, regardless of where it resides or who requests it?
- Accountability
- Data sovereignty
- Tranquility (Correct answer)
- Aggregation
Correct answer: Tranquility
The tranquility principle in the Bell-LaPadula model states that security labels do not change while subjects are actively accessing objects, preserving classification integrity.
Question 6: A zero-day vulnerability is being actively exploited in the wild before a patch is available. Which interim security control BEST reduces exposure?
- Disabling the affected application entirely
- Applying compensating controls such as WAF rules, network segmentation, or enhanced monitoring (Correct answer)
- Waiting for the vendor patch and taking no action
- Performing a full system restore from last night's backup
Correct answer: Applying compensating controls such as WAF rules, network segmentation, or enhanced monitoring
Compensating controls provide risk reduction when a patch is unavailable by limiting exploitability through alternative protective measures.
Question 7: Which international standard provides a framework specifically for information security incident management processes?
- ISO/IEC 27035 (Correct answer)
- NIST SP 800-53
- PCI DSS Requirement 12
- COBIT 2019
Correct answer: ISO/IEC 27035
ISO/IEC 27035 is the international standard dedicated to information security incident management, covering planning, detection, assessment, response, and lessons learned.
CISSP Security Operations 5
Which concept in security operations describes the process of proactively searching for threats that have evaded existing security controls?