A healthcare organization's continuous monitoring program collects and stores detailed patient access logs in a SIEM for security analysis. A new privacy regulation requires that personal data be retained only for a specific period and that access to this data be logged. What is the most appropriate action for the organization to take?

Implement automated retention policies that purge logs after the required period

Anonymize logs only when a security incident occurs

Store logs in a separate database without access controls

Delete all logs immediately to avoid privacy violations

A security operations center monitors a web application. The SIEM uses a rule that flags any request containing a known SQL injection pattern. An attacker obfuscates the payload using URL encoding, and the rule does not fire. Which enhancement would most directly improve detection of this variant?

Add a correlation rule that links web server logs with database error logs

Deploy an anomaly-based detection model that learns normal request patterns

Normalize all web logs to a common schema before analysis

Increase the alert threshold to reduce false positives

After a malware outbreak, the incident response team eradicates the threat from all affected systems and restores them from clean backups. Before closing the incident, what is the most important remaining step in the incident response process?

Delete all logs related to the incident to free storage

Notify all customers without internal review

Immediately change all passwords without documentation

Conduct a lessons learned review to identify improvements

During an incident, the SIEM shows that an attacker has compromised a server and is using it to scan the internal network. The incident response team wants to contain the threat while preserving evidence and minimizing business disruption. The server hosts a critical application that cannot be taken offline. Which action best balances these constraints?

Shut down the server to preserve evidence

Disconnect the server from the network immediately

Do nothing until the attacker's identity is known

Apply a firewall rule to block the server's outbound scanning traffic while allowing legitimate application traffic

Certified Secure Software Lifecycle Professional

Domain 7Objective 7

Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 3)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

11%of the exam

Questions 11–15

11application · medium
A healthcare organization's continuous monitoring program collects and stores detailed patient access logs in a SIEM for security analysis. A new privacy regulation requires that personal data be retained only for a specific period and that access to this data be logged. What is the most appropriate action for the organization to take?
Select an answer first
12foundation · easy
Which type of observable data is typically a structured record of a specific action or occurrence, such as a user login or a firewall rule match?
Select an answer first
13application · medium
A security operations center monitors a web application. The SIEM uses a rule that flags any request containing a known SQL injection pattern. An attacker obfuscates the payload using URL encoding, and the rule does not fire. Which enhancement would most directly improve detection of this variant?
Select an answer first
14application · medium
After a malware outbreak, the incident response team eradicates the threat from all affected systems and restores them from clean backups. Before closing the incident, what is the most important remaining step in the incident response process?
Select an answer first
15expert · hard
During an incident, the SIEM shows that an attacker has compromised a server and is using it to scan the internal network. The incident response team wants to contain the threat while preserving evidence and minimizing business disruption. The server hosts a critical application that cannot be taken offline. Which action best balances these constraints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 3)

Questions 11–15

Which type of observable data is typically a structured record of a specific action or occurrence, such as a user login or a firewall rule match?

A security operations center monitors a web application. The SIEM uses a rule that flags any request containing a known SQL injection pattern. An attacker obfuscates the payload using URL encoding, and the rule does not fire. Which enhancement would most directly improve detection of this variant?

After a malware outbreak, the incident response team eradicates the threat from all affected systems and restores them from clean backups. Before closing the incident, what is the most important remaining step in the incident response process?

Keep studying — Secure Software Deployment, Operations, Maintenance