Security Operations GISP Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A company's disaster recovery plan specifies a recovery time objective (RTO) of 4 hours for its customer-facing application. A security incident has corrupted the application's database. The backup is stored on-site and is also corrupted. The company has an off-site backup that is 12 hours old. What is the best course of action to meet the RTO?

   • ADeclare the disaster and wait for the vendor to provide a new database.
   • BRestore from the on-site backup and hope it works.
   • CAttempt to repair the corrupted on-site backup before restoring.
   • DRestore from the off-site backup and accept that data may be up to 12 hours old.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A SOC team spends significant time manually collecting logs, checking IoCs, and opening tickets for every alert. They want to reduce response time and human error. Which technology would best address this need?

   • AIncrease the number of SOC analysts to handle the workload.
   • BPurchase a new SIEM with more correlation rules.
   • CDeploy a SOAR platform to automate repetitive tasks and orchestrate response workflows.
   • DImplement a ticketing system with more fields.
   Reveal Solution Discussion Select an answer first
4. 53application · medium

   A vulnerability scanner identifies a critical remote code execution vulnerability in a business-critical application server. The vendor has released a patch, but applying it requires a reboot that will cause a 30-minute outage during business hours. The server is internet-facing and has been targeted by exploit attempts. What should the security team do first?

   • ADisconnect the server from the internet until the patch can be applied.
   • BApply the patch immediately, accepting the outage to eliminate the risk.
   • CWait for the next scheduled patch cycle, which is two weeks away, to avoid any disruption.
   • DImplement temporary mitigations such as an IPS rule or access control list, then schedule the patch during the next maintenance window.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A vulnerability scan reveals a critical vulnerability in a legacy application that is no longer supported by the vendor. The application is essential to business operations and cannot be replaced immediately. What is the most appropriate risk treatment?

   • AApply compensating controls, such as network segmentation and strict access controls, to reduce the risk.
   • BIgnore the vulnerability because the vendor no longer supports the application.
   • CRemove the application immediately to eliminate the vulnerability.
   • DAccept the risk without any action because the application is essential.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A SOC is implementing a new shift schedule. The team wants to ensure that alerts are monitored 24/7 and that escalation paths are clear. Which practice is most important to implement?

   • ARequire all analysts to work the same shift to ensure consistency.
   • BAllow analysts to decide independently which alerts to escalate.
   • CDefine roles and responsibilities for each shift, including a primary and secondary escalation contact.
   • DOnly monitor alerts during business hours to reduce costs.
   Reveal Solution Discussion Select an answer first