A company's security team has detected a potential ransomware infection on a critical file server. The incident response plan requires immediate containment. Which of the following actions should be taken first?

Run a full antivirus scan on the file server to identify the ransomware variant.

Isolate the file server from the network by disconnecting it from the switch.

Notify the legal department and prepare a public statement.

Restore the file server from the most recent backup.

A large enterprise wants to automate the response to common security incidents, such as phishing emails reported by employees. The security operations center (SOC) currently manually reviews each report and creates a ticket. Which of the following is the most appropriate automation to implement?

Implement a machine learning model to predict which emails are phishing and delete them before delivery.

Create a distribution list for employees to forward phishing emails to the SOC manually.

Use a security orchestration, automation, and response (SOAR) platform to automatically quarantine the reported email and create a ticket.

Configure the email gateway to automatically block all emails with the subject 'phishing'.

A security operations center (SOC) is overwhelmed with alerts from multiple security tools. The team wants to reduce alert fatigue and improve response times. They are considering implementing a SOAR platform. Which of the following is the most important consideration when planning the SOAR implementation?

Purchase the most expensive SOAR platform available to ensure it has all features.

Define clear playbooks for automated response actions and ensure they are tested regularly.

Integrate the SOAR with every security tool in the environment, regardless of relevance.

Automate all alert responses without human review to maximize efficiency.

What is the purpose of a secure configuration baseline?

To automatically patch all software vulnerabilities

To provide a starting point for system hardening that meets security requirements

To replace the need for ongoing security monitoring

To document the history of all configuration changes made to a system

What is the purpose of the containment phase in incident response?

To collect evidence for legal proceedings

To identify the root cause of the incident

To limit the damage and prevent the incident from spreading

To restore systems to normal operation

Information Systems Security Engineering Professional

Domain 4Objective 1

Implement and Integrate Security Solutions ISSEP Practice Questions (Page 1)

Part of the Systems Security Implementation, Verification and Validation domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

10concepts

20%of the exam

Questions 1–5

1application · medium
A company's security team has detected a potential ransomware infection on a critical file server. The incident response plan requires immediate containment. Which of the following actions should be taken first?
Select an answer first
2application · medium
A large enterprise wants to automate the response to common security incidents, such as phishing emails reported by employees. The security operations center (SOC) currently manually reviews each report and creates a ticket. Which of the following is the most appropriate automation to implement?
Select an answer first
3expert · hard
A security operations center (SOC) is overwhelmed with alerts from multiple security tools. The team wants to reduce alert fatigue and improve response times. They are considering implementing a SOAR platform. Which of the following is the most important consideration when planning the SOAR implementation?
Select an answer first
4foundation · easy
What is the purpose of a secure configuration baseline?
Select an answer first
5foundation · easy
What is the purpose of the containment phase in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.