A security operations team has been running a SIEM for six months. The team notices that a particular correlation rule has not generated any alerts in the past three months, despite being triggered frequently in the first three months. The team suspects the rule may be broken or the threat has been mitigated. What is the most appropriate action?

Create a new rule that is similar to the original rule to see if it generates alerts.

Increase the severity of the rule to ensure it gets attention if it triggers again.

Disable the rule because it is no longer generating alerts.

Review the rule's logic and the underlying log sources to determine why it is no longer triggering.

A security analyst is reviewing logs after a suspected breach. The analyst finds that a user account was used to log in from the corporate office at 10:00 AM and from a foreign country at 10:05 AM. The analyst also sees that the same account was used to access a file share containing sensitive data at 10:06 AM. What is the most likely conclusion?

The account is compromised, and the attacker is using it to access sensitive data.

The user is using a VPN that routes traffic through a foreign country.

The logs are incorrect due to a time synchronization issue.

The user has a legitimate need to access the file share from both locations.

A security team has completed a thorough review of its SIEM alerts and found no indicators of compromise. However, the team suspects that a sophisticated attacker may have evaded detection. The team decides to conduct a threat hunting exercise. What is the most effective first step in this process?

Deploy additional IDS sensors at the network perimeter to increase visibility.

Develop a hypothesis based on the attacker's likely tactics, techniques, and procedures (TTPs).

Search the SIEM logs for any event that occurred outside of normal business hours.

Review the threat intelligence feeds for new indicators of compromise and search for them.

What is the primary difference between threat hunting and traditional security monitoring?

Threat hunting is proactive, while monitoring is typically reactive

Threat hunting uses automated tools, while monitoring is manual

Threat hunting is reactive, while monitoring is proactive

Threat hunting is only for external threats

Certified Information Systems Security Professional

Domain 7Objective 2

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 5)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

13%of the exam

Questions 21–25

21expert · hard
A security operations team has been running a SIEM for six months. The team notices that a particular correlation rule has not generated any alerts in the past three months, despite being triggered frequently in the first three months. The team suspects the rule may be broken or the threat has been mitigated. What is the most appropriate action?
Select an answer first
22application · medium
A security analyst is reviewing logs after a suspected breach. The analyst finds that a user account was used to log in from the corporate office at 10:00 AM and from a foreign country at 10:05 AM. The analyst also sees that the same account was used to access a file share containing sensitive data at 10:06 AM. What is the most likely conclusion?
Select an answer first
23expert · hard
A security team has completed a thorough review of its SIEM alerts and found no indicators of compromise. However, the team suspects that a sophisticated attacker may have evaded detection. The team decides to conduct a threat hunting exercise. What is the most effective first step in this process?
Select an answer first
24foundation · easy
What is the primary difference between threat hunting and traditional security monitoring?
Select an answer first
25foundation · easy
Which IDPS response action is considered the most disruptive to an ongoing attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 5)

Questions 21–25

A security team has completed a thorough review of its SIEM alerts and found no indicators of compromise. However, the team suspects that a sophisticated attacker may have evaded detection. The team decides to conduct a threat hunting exercise. What is the most effective first step in this process?

What is the primary difference between threat hunting and traditional security monitoring?

Which IDPS response action is considered the most disruptive to an ongoing attack?

Keep studying — Security Operations