Security Operations GISP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an incident investigation, a forensic analyst needs to collect the contents of a compromised server's memory. The server is still running and is critical to the business. What is the most appropriate action?

   • ACopy the memory dump file from the system's page file.
   • BPower off the server immediately and then image the hard drive.
   • CPerform a live memory acquisition using a trusted forensic tool.
   • DWait until the server can be taken offline during a maintenance window.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a Security Operations Center (SOC), which role is primarily responsible for monitoring alerts and determining whether an alert represents a genuine security incident?

   • AIncident Commander
   • BSOC Manager
   • CTier 1 Analyst
   • DTier 3 Analyst
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is triaging multiple alerts. One alert indicates a potential ransomware infection on a single workstation, another indicates a phishing email that was blocked by the gateway, and a third indicates a failed login attempt on a non-critical system. Which alert should be escalated first?

   • AThe failed login alert, because it may indicate a brute-force attack.
   • BThe ransomware alert, because it indicates a high-impact, active threat.
   • CThe phishing email alert, because it may indicate a targeted attack.
   • DAll alerts should be escalated simultaneously.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the key difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS is placed inline, while an IPS is placed out-of-band
   • BAn IDS is a hardware device, while an IPS is software only
   • CAn IDS monitors and alerts, while an IPS can also block malicious traffic
   • DAn IDS uses signatures, while an IPS uses only behavioral analysis
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A vulnerability scanner identifies a critical vulnerability on an internet-facing web server. The patch is available but requires a reboot, which will cause downtime. The server is business-critical and cannot be taken offline during business hours. What is the best course of action?

   • ADisable the web server until the patch can be applied.
   • BApply the patch during the next scheduled maintenance window and implement temporary mitigations.
   • CIgnore the vulnerability because the server is protected by a firewall.
   • DApply the patch immediately, accepting the downtime.
   Reveal Solution Discussion Select an answer first