Manage Security Operations CCSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the main purpose of the 'lessons learned' phase in incident response?

   • ATo immediately restore all systems without review
   • BTo delete all evidence related to the incident
   • CTo document the incident and improve future response capabilities
   • DTo assign blame to individuals responsible for the incident
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is establishing a SOC and needs to decide on the staffing model. The company has a limited budget but requires 24/7 monitoring. Which staffing model is MOST appropriate?

   • AAn in-house SOC that monitors only during business hours.
   • BA fully outsourced SOC with no in-house security staff.
   • CA hybrid model with in-house analysts during business hours and a managed SOC provider after hours.
   • DA fully in-house SOC with three shifts of analysts.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is planning to conduct a vulnerability assessment of its cloud infrastructure. The security team wants to identify known vulnerabilities in their systems and prioritize remediation efforts. Which activity is MOST appropriate for this objective?

   • ARun an automated vulnerability scanner against the infrastructure and analyze the results.
   • BAnalyze threat intelligence feeds to identify emerging threats.
   • CReview the security group configurations to identify misconfigurations.
   • DPerform a penetration test to exploit vulnerabilities and assess the impact.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key consideration when storing logs for security analysis?

   • AProtecting logs from tampering and unauthorized access
   • BDeleting logs after 30 days to save storage costs
   • CEnsuring logs are accessible to all employees
   • DStoring logs in plain text for easy readability
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is planning a penetration test of its cloud infrastructure. The test must be conducted without disrupting production services. Which type of penetration test would be MOST appropriate?

   • AA white-box test that includes denial-of-service attacks to test resilience.
   • BA black-box test that uses only passive reconnaissance techniques.
   • CA gray-box test that focuses on exploiting vulnerabilities without causing service disruption.
   • DA red-team exercise that simulates a full-scale attack, including social engineering.
   Reveal Solution Discussion Select an answer first