A government agency is hiring contractors to support its security operations center. The agency requires that all SOC personnel be able to handle sensitive information and have verifiable expertise in incident detection. Which two requirements should the agency specify in the contract?

A security clearance and a recognized security certification

Five years of customer service experience and a driver's license

A college degree in business and a valid passport

A recommendation from a previous employer and a clean credit report

A secure operations plan is being developed for a financial institution. The plan must define the roles responsible for reviewing audit logs, managing user access, and responding to security incidents. Which set of roles should be assigned these responsibilities?

Chief financial officer, human resources manager, and legal counsel

External auditor, vendor, and consultant

Network engineer, database administrator, and help desk technician

Security analyst, access administrator, and incident responder

A defense contractor is developing a secure operations plan for a new facility that will process controlled unclassified information. The plan must clearly define who is responsible for monitoring security alerts, conducting initial triage, and escalating incidents to the incident response team. Which role should be assigned these responsibilities in the plan?

Security Operations Center (SOC) Analyst

Chief Information Security Officer (CISO)

According to typical security event reporting requirements, which of the following events must be reported to the appropriate security incident response team?

An unauthorized attempt to access a system by an unknown user

A user changing their password after forgetting it

A user receiving a phishing email but not clicking on any links

A scheduled system maintenance window

A security analyst notices repeated failed login attempts against a critical server from an internal IP address. The attempts have not yet succeeded. According to the organization's security event reporting requirements, which action should the analyst take?

Ignore the attempts because they were unsuccessful

Report the event at the end of the month in the regular status report

Report the event to the incident response team immediately, even though access was not gained

Wait until a successful login occurs before reporting

Information Systems Security Engineering Professional

Domain 5Objective 1

Develop Secure Operations Plan ISSEP Practice Questions (Page 2)

Part of the Secure Operations, Change Management and Disposal domain, which accounts for 14% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

3concepts

14%of the exam

Questions 6–10

6application · medium
A government agency is hiring contractors to support its security operations center. The agency requires that all SOC personnel be able to handle sensitive information and have verifiable expertise in incident detection. Which two requirements should the agency specify in the contract?
Select an answer first
7application · medium
A secure operations plan is being developed for a financial institution. The plan must define the roles responsible for reviewing audit logs, managing user access, and responding to security incidents. Which set of roles should be assigned these responsibilities?
Select an answer first
8application · medium
A defense contractor is developing a secure operations plan for a new facility that will process controlled unclassified information. The plan must clearly define who is responsible for monitoring security alerts, conducting initial triage, and escalating incidents to the incident response team. Which role should be assigned these responsibilities in the plan?
Select an answer first
9foundation · easy
According to typical security event reporting requirements, which of the following events must be reported to the appropriate security incident response team?
Select an answer first
10application · medium
A security analyst notices repeated failed login attempts against a critical server from an internal IP address. The attempts have not yet succeeded. According to the organization's security event reporting requirements, which action should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.