A security architect is selecting a firewall to inspect application-layer protocols, such as HTTP and SQL, and make decisions based on the content of the traffic rather than just ports and IP addresses. Which type of firewall is specifically designed for this purpose?

Stateful packet filtering firewall

Next-generation firewall (NGFW)

A security team wants to set up a network of decoy systems that appear to be various types of servers (e.g., database, web, file) to attract attackers and gather intelligence on their methods. They want to ensure that the decoys are isolated from the production network. Which solution should they deploy?

An intrusion detection system (IDS)

A network firewall with logging

A company wants to restrict access to its internal network to only a set of known business partners. They have a list of partner IP addresses. They also want to block all other traffic by default. Which approach should they use?

IP blacklisting on the firewall, blocking known malicious IPs

Deploy an IDS to monitor for suspicious traffic

Use a web application firewall (WAF) to filter HTTP traffic

IP whitelisting on the firewall, allowing only the partner IP addresses

A company is considering outsourcing its security monitoring to a third-party provider that will analyze logs, correlate events, and provide alerts. The company wants to retain control over incident response. Which third-party service model best fits this need?

Vulnerability management service

Managed Detection and Response (MDR)

Certified Information Systems Security Professional

Domain 7Objective 7

7.7 - Operate and Maintain Detection and Preventative Measures CISSP Practice Questions (Page 5)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

13%of the exam

Questions 21–25

21foundation · easy
A security architect is selecting a firewall to inspect application-layer protocols, such as HTTP and SQL, and make decisions based on the content of the traffic rather than just ports and IP addresses. Which type of firewall is specifically designed for this purpose?
Select an answer first
22foundation · easy
A security analyst needs to execute a suspicious file to observe its behavior without risking the production environment. Which technique is most appropriate?
Select an answer first
23application · medium
A security team wants to set up a network of decoy systems that appear to be various types of servers (e.g., database, web, file) to attract attackers and gather intelligence on their methods. They want to ensure that the decoys are isolated from the production network. Which solution should they deploy?
Select an answer first
24application · medium
A company wants to restrict access to its internal network to only a set of known business partners. They have a list of partner IP addresses. They also want to block all other traffic by default. Which approach should they use?
Select an answer first
25application · medium
A company is considering outsourcing its security monitoring to a third-party provider that will analyze logs, correlate events, and provide alerts. The company wants to retain control over incident response. Which third-party service model best fits this need?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.7 - Operate and Maintain Detection and Preventative Measures CISSP Practice Questions (Page 5)

Questions 21–25

A security architect is selecting a firewall to inspect application-layer protocols, such as HTTP and SQL, and make decisions based on the content of the traffic rather than just ports and IP addresses. Which type of firewall is specifically designed for this purpose?

A security analyst needs to execute a suspicious file to observe its behavior without risking the production environment. Which technique is most appropriate?

A company wants to restrict access to its internal network to only a set of known business partners. They have a list of partner IP addresses. They also want to block all other traffic by default. Which approach should they use?

A company is considering outsourcing its security monitoring to a third-party provider that will analyze logs, correlate events, and provide alerts. The company wants to retain control over incident response. Which third-party service model best fits this need?

Keep studying — Security Operations