A security team wants to learn about the tactics, techniques, and procedures (TTPs) of attackers targeting their network. They plan to deploy a system that appears to be a vulnerable server but is actually isolated and monitored. The goal is to attract attackers and observe their behavior. Which solution should they deploy?

A network firewall with logging enabled

An intrusion detection system (IDS)

A security analyst receives an email attachment from an unknown sender. The file appears to be a PDF, but the analyst is unsure if it is malicious. They want to analyze the file's behavior without risking the production environment. Which technique should they use?

Scan the file with signature-based anti-malware

Run the file in a sandbox environment

Open the file on a production workstation with anti-malware enabled

Check the file's hash against a threat intelligence feed

An organization wants to actively block malicious traffic in real time without requiring human intervention. Which system is designed to do this?

Intrusion Detection System (IDS)

Intrusion Prevention System (IPS)

Security Information and Event Management (SIEM)

A company's anti-malware solution is missing polymorphic malware that changes its code to avoid signature detection. The security team wants to improve detection of such malware. Which approach would be most effective?

Increase the frequency of signature updates

Use a sandbox to analyze all files

Deploy a network firewall with URL filtering

Use behavioral analysis that monitors for malicious actions at runtime

A security team receives a suspicious file from a customer. They want to determine if the file contains malware by executing it and observing its behavior, but they are concerned about the file communicating with external command-and-control servers. Which approach should they take?

Execute the file on an isolated virtual machine with no network connection

Execute the file in a sandbox with network access disabled or monitored

Open the file on a production workstation with anti-malware running

Scan the file with multiple anti-malware engines

Certified Information Systems Security Professional

Domain 7Objective 7

7.7 - Operate and Maintain Detection and Preventative Measures CISSP Practice Questions (Page 4)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

13%of the exam

Questions 16–20

16application · medium
A security team wants to learn about the tactics, techniques, and procedures (TTPs) of attackers targeting their network. They plan to deploy a system that appears to be a vulnerable server but is actually isolated and monitored. The goal is to attract attackers and observe their behavior. Which solution should they deploy?
Select an answer first
17application · medium
A security analyst receives an email attachment from an unknown sender. The file appears to be a PDF, but the analyst is unsure if it is malicious. They want to analyze the file's behavior without risking the production environment. Which technique should they use?
Select an answer first
18foundation · easy
An organization wants to actively block malicious traffic in real time without requiring human intervention. Which system is designed to do this?
Select an answer first
19application · medium
A company's anti-malware solution is missing polymorphic malware that changes its code to avoid signature detection. The security team wants to improve detection of such malware. Which approach would be most effective?
Select an answer first
20application · medium
A security team receives a suspicious file from a customer. They want to determine if the file contains malware by executing it and observing its behavior, but they are concerned about the file communicating with external command-and-control servers. Which approach should they take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.