A SOC is overwhelmed by the volume of alerts from its SIEM, many of which are low-priority. The team wants to reduce alert fatigue while ensuring that critical threats are not missed. Which strategy is MOST effective?

Increase the severity threshold for all alerts so only high-severity alerts are generated.

Disable all alerts that are not related to critical assets.

Implement a triage process that prioritizes alerts based on risk and context.

Add more threat intelligence feeds to increase the accuracy of alerts.

A security team is investigating a potential data breach. The team has access to logs from the SIEM, firewall, and authentication system. Which actions are appropriate for the investigation? (Select all that apply.)

Immediately notify all employees about the breach.

Use threat intelligence to identify if the attacker's IP is known.

Delete logs that are not relevant to the investigation to reduce noise.

Correlate authentication logs with firewall logs to identify the source of the breach.

Preserve the logs as evidence for potential legal action.

What is the primary purpose of a vulnerability assessment?

To identify and prioritize security weaknesses in systems

To comply with all regulatory requirements automatically

To exploit vulnerabilities to demonstrate impact

To ensure all systems are patched to the latest version

A security team is deciding between conducting a vulnerability assessment and a penetration test for a new cloud application. The goal is to determine whether a specific known vulnerability can be exploited to gain unauthorized access to sensitive data. Which approach should the team choose?

Vulnerability assessment, because it identifies the vulnerability and provides remediation steps.

Both, because a penetration test includes a vulnerability assessment as its first phase.

Neither, because the team should rely on threat intelligence to assess exploitability.

Penetration test, because it actively exploits the vulnerability to assess the impact.

A company's SOC receives an alert from its SIEM indicating a possible brute-force attack against a critical database server. The alert was generated by correlating failed login events with a known threat intelligence feed. The SOC analyst confirms the attack is ongoing. According to the incident response process, what should the analyst do FIRST?

Notify the incident response team and begin the detection and analysis phase.

Contain the threat by isolating the database server from the network.

Document the alert details and preserve evidence for later forensic analysis.

Verify the alert is a true positive and gather initial information about the attack.

Certified Cloud Security Professional

Domain 5Objective 6

Manage Security Operations CCSP Practice Questions (Page 1)

Part of the Cloud Security Operations domain, which accounts for 17% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~12–20 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

17%of the exam

Questions 1–5

1expert · hard
A SOC is overwhelmed by the volume of alerts from its SIEM, many of which are low-priority. The team wants to reduce alert fatigue while ensuring that critical threats are not missed. Which strategy is MOST effective?
Select an answer first
2expert · hard · select all that apply
A security team is investigating a potential data breach. The team has access to logs from the SIEM, firewall, and authentication system. Which actions are appropriate for the investigation? (Select all that apply.)
Select an answer first
3foundation · easy
What is the primary purpose of a vulnerability assessment?
Select an answer first
4application · medium
A security team is deciding between conducting a vulnerability assessment and a penetration test for a new cloud application. The goal is to determine whether a specific known vulnerability can be exploited to gain unauthorized access to sensitive data. Which approach should the team choose?
Select an answer first
5application · medium
A company's SOC receives an alert from its SIEM indicating a possible brute-force attack against a critical database server. The alert was generated by correlating failed login events with a known threat intelligence feed. The SOC analyst confirms the attack is ongoing. According to the incident response process, what should the analyst do FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.