Support Secure Operations ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A global organization has a distributed incident response team. During a major incident, the team must coordinate across multiple time zones and legal jurisdictions. The organization wants to ensure that the incident response process is effective while respecting local laws. Which approach best balances these requirements?

   • AEstablish a global incident response playbook that includes legal review checkpoints and allows regional teams to adapt procedures to local laws.
   • BLet each regional team handle incidents independently without a global playbook.
   • CRequire all incident response activities to be approved by a central legal team before execution.
   • DUse a single incident response plan that ignores local legal differences for simplicity.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In designing a continuous monitoring capability, which of the following is a key element that must be addressed?

   • AFocusing solely on technology solutions without considering organizational processes
   • BEliminating all manual processes to achieve full automation
   • CEnsuring that monitoring data is never stored to avoid privacy concerns
   • DDefining the roles and responsibilities of personnel involved in monitoring activities
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is developing an incident response plan. The plan must ensure that during a major incident, the right people are notified quickly and that communication is coordinated. The organization has a 24/7 security operations center (SOC). What should the plan include to achieve this?

   • AA decision to wait until the incident is fully understood before notifying anyone.
   • BA communication tree that defines who to notify, in what order, and through which channels, with escalation procedures.
   • CA requirement that all communication be done via email to maintain a record.
   • DA policy that only the SOC manager can communicate about incidents.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A critical infrastructure operator must perform maintenance on a system that cannot be taken offline. The maintenance requires a firmware update that typically requires a reboot. The operator has redundant systems, but there is a risk that the update could fail and leave the system in an inconsistent state. What is the best approach to perform this maintenance securely?

   • APerform the update on one redundant system at a time, with a rollback plan and continuous monitoring during the process.
   • BSkip the firmware update to avoid any risk of failure.
   • CPerform the update without monitoring or a rollback plan to save time.
   • DUpdate all systems simultaneously to complete the maintenance faster.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization is implementing a continuous monitoring program. The program must comply with regulations that require prompt detection of security incidents. The organization has a mix of legacy and modern systems. What is the best way to design the monitoring program?

   • AFocus monitoring only on modern systems that support agent-based monitoring.
   • BRely on manual log reviews for legacy systems and automated monitoring for modern systems.
   • CUse a combination of agent-based and agentless monitoring to cover both modern and legacy systems, with centralized alerting.
   • DUse agentless monitoring only, as it is easier to deploy.
   Reveal Solution Discussion Select an answer first