Security Operations and Monitoring CISA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following best describes the purpose of penetration testing?

   • ATo simulate an attack to determine the extent to which security controls can be bypassed
   • BTo monitor and analyze security events in real time
   • CTo ensure that all software patches are up to date
   • DTo identify known vulnerabilities without actively exploiting them
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization wants to assess the security of its internal network without disrupting operations. They have a limited budget and need to identify the most critical vulnerabilities. Which approach is most cost-effective and least disruptive?

   • AFull penetration test with social engineering
   • BManual code review of all applications
   • CAutomated vulnerability scan with risk prioritization
   • DDeploy an IDS and wait for alerts
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst notices that a server is sending encrypted traffic to an external IP address at regular intervals. The traffic volume is low, but the destination is not on any approved list. Which type of attack is most likely?

   • ADenial of service attack
   • BMan-in-the-middle attack
   • CData exfiltration via covert channel
   • DSocial engineering attack
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's SIEM generates an alert for a single workstation showing multiple failed logon attempts followed by a successful logon from an IP address in a foreign country. The workstation user is currently on vacation. Which action should the security analyst take FIRST?

   • ADisable the user's account and reset the password
   • BReview the raw logs and correlate with other events to validate the alert
   • CBlock the foreign IP address at the firewall
   • DContact the user to confirm if they accessed the system remotely
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a potential data breach. The SIEM shows that a user account was used to access a sensitive database at 2:00 AM, but the user's physical badge was not used to enter the building that day. Which type of attack is most likely indicated?

   • ASocial engineering attack
   • BMalware infection
   • CCredential theft or account compromise
   • DDenial of service attack
   Reveal Solution Discussion Select an answer first