Implement Secure Operation Practices CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a security incident, the incident response team identifies a malicious file on a critical server. The team isolates the server from the network. According to a well-defined incident response plan, what should the team do next?

   • AImmediately delete the malicious file to eradicate the threat.
   • BCollect and preserve forensic evidence from the server.
   • CRestore the server from the latest backup.
   • DNotify the public relations team to issue a press release.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How is authorization maintained over time in the A&A process?

   • ABy performing a one-time assessment at system deployment
   • BBy relying solely on the original authorization without further action
   • CBy conducting continuous monitoring and periodic re-assessment
   • DBy re-authorizing only when a major incident occurs
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the Assessment and Authorization (A&A) process, what is the primary output of the security assessment step?

   • AA plan of action and milestones (POA&M)
   • BA formal authorization decision
   • CA system security plan (SSP)
   • DA security assessment report (SAR)
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is evaluating a new software product to determine if it meets the security requirements defined in the project charter. The team is checking whether the product's security features are implemented correctly. This activity is an example of:

   • AVerification
   • BRisk assessment
   • CAuthorization
   • DValidation
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A critical production application is experiencing a security incident. The incident response team needs to apply an emergency configuration change to mitigate the attack. The change is outside the normal change management window. What is the best approach?

   • AWait for the next scheduled change window to avoid disrupting the change management process.
   • BRequest a full CAB meeting before applying the change.
   • CApply the change immediately and document it retrospectively.
   • DApply the change without any documentation to save time.
   Reveal Solution Discussion Select an answer first