A security analyst is investigating a slow performance degradation in a critical application. The SIEM shows no authentication failures or unauthorized access, but the application's response time has increased steadily over the past week. Which type of observable data would be most useful to identify the root cause?

Metrics such as CPU, memory, and response time

A company wants to integrate threat intelligence feeds, vulnerability scanner results, and asset inventory into their SIEM to prioritize alerts based on business impact. The asset inventory is incomplete and not automatically updated. What is the most important first step?

Automate asset inventory updates to ensure accurate data for prioritization

Integrate vulnerability scanner results to identify weaknesses

Integrate the threat intelligence feeds first to improve detection

Configure the SIEM to alert on all events to avoid missing anything

How can a change in privacy regulations impact continuous monitoring practices?

It may require restrictions on the collection and retention of personal data in logs

It has no impact on monitoring because security is always exempt

It requires all monitoring data to be deleted immediately

It only affects external monitoring, not internal monitoring

Certified Secure Software Lifecycle Professional

Domain 7Objective 7

Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 4)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

11%of the exam

Questions 16–20

16application · medium
A security analyst is investigating a slow performance degradation in a critical application. The SIEM shows no authentication failures or unauthorized access, but the application's response time has increased steadily over the past week. Which type of observable data would be most useful to identify the root cause?
Select an answer first
17foundation · easy
In the incident response process, which step involves limiting the scope and impact of an incident?
Select an answer first
18expert · hard
A company wants to integrate threat intelligence feeds, vulnerability scanner results, and asset inventory into their SIEM to prioritize alerts based on business impact. The asset inventory is incomplete and not automatically updated. What is the most important first step?
Select an answer first
19foundation · easy
How can a change in privacy regulations impact continuous monitoring practices?
Select an answer first
20foundation · easy
Which source of threat intelligence is typically maintained by a community of volunteers and is freely available to the public?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 4)

Questions 16–20

In the incident response process, which step involves limiting the scope and impact of an incident?

A company wants to integrate threat intelligence feeds, vulnerability scanner results, and asset inventory into their SIEM to prioritize alerts based on business impact. The asset inventory is incomplete and not automatically updated. What is the most important first step?

How can a change in privacy regulations impact continuous monitoring practices?

Which source of threat intelligence is typically maintained by a community of volunteers and is freely available to the public?

Keep studying — Secure Software Deployment, Operations, Maintenance