A security operations plan requires that all security incidents be reported to the CISO within 24 hours. A network administrator notices unusual outbound traffic from a server but is unsure if it is malicious. What should the administrator do?

Wait for the traffic to become clearly malicious before reporting

Report the traffic only if the server is compromised

Ignore the traffic because it may be benign

Report the unusual traffic to the CISO as a potential security incident

A multinational corporation is developing a secure operations plan for its cloud-based infrastructure. The plan must define roles for monitoring, incident response, and compliance reporting. The company has a small security team and wants to minimize the number of personnel while ensuring clear accountability. Which approach should the plan take?

Use automated tools to eliminate the need for human monitoring

Create separate roles for each function, even if it requires hiring more staff

Outsource all security operations to a third-party provider

Assign multiple responsibilities to a single security analyst, with clear escalation paths

Which of the following is a typical requirement for system security personnel to ensure they can effectively perform their duties?

A certification in project management (PMP)

A minimum of five years of experience in law enforcement

Completion of role-specific security training

A government contractor must staff a security operations center that handles classified information. The contract requires that all SOC personnel have a Top Secret clearance and a relevant certification. The contractor is having difficulty finding qualified candidates. What should the contractor do to meet the requirement?

Reduce the certification requirement to attract more candidates

Hire personnel with only a Secret clearance and train them on the job

Use automated systems to reduce the number of personnel needed

Provide training and sponsor clearances for promising candidates

An organization's security event reporting policy requires that all security incidents be reported to the CISO within 1 hour. A security analyst discovers a potential malware infection on a server. The analyst is not sure if the infection is real or a false positive. What should the analyst do?

Report the potential infection to the CISO immediately

Investigate further to confirm the infection before reporting

Report the incident to the system administrator instead of the CISO

Ignore the alert because it may be a false positive

Information Systems Security Engineering Professional

Domain 5Objective 1

Develop Secure Operations Plan ISSEP Practice Questions (Page 1)

Part of the Secure Operations, Change Management and Disposal domain, which accounts for 14% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

3concepts

14%of the exam

Questions 1–5

1application · medium
A security operations plan requires that all security incidents be reported to the CISO within 24 hours. A network administrator notices unusual outbound traffic from a server but is unsure if it is malicious. What should the administrator do?
Select an answer first
2expert · hard
A multinational corporation is developing a secure operations plan for its cloud-based infrastructure. The plan must define roles for monitoring, incident response, and compliance reporting. The company has a small security team and wants to minimize the number of personnel while ensuring clear accountability. Which approach should the plan take?
Select an answer first
3foundation · easy
Which of the following is a typical requirement for system security personnel to ensure they can effectively perform their duties?
Select an answer first
4expert · hard
A government contractor must staff a security operations center that handles classified information. The contract requires that all SOC personnel have a Top Secret clearance and a relevant certification. The contractor is having difficulty finding qualified candidates. What should the contractor do to meet the requirement?
Select an answer first
5expert · hard
An organization's security event reporting policy requires that all security incidents be reported to the CISO within 1 hour. A security analyst discovers a potential malware infection on a server. The analyst is not sure if the infection is real or a false positive. What should the analyst do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Develop Secure Operations Plan ISSEP Practice Questions (Page 1)

Questions 1–5

A security operations plan requires that all security incidents be reported to the CISO within 24 hours. A network administrator notices unusual outbound traffic from a server but is unsure if it is malicious. What should the administrator do?

Which of the following is a typical requirement for system security personnel to ensure they can effectively perform their duties?

An organization's security event reporting policy requires that all security incidents be reported to the CISO within 1 hour. A security analyst discovers a potential malware infection on a server. The analyst is not sure if the infection is real or a false positive. What should the analyst do?

Keep studying — Secure Operations, Change Management and Disposal