Support Secure Operations ISSEP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise is designing a continuous monitoring program. The program must detect insider threats, which are often subtle and occur over time. The enterprise has a high volume of user activity data. Which monitoring design is most effective for detecting insider threats?

   • AUse manual review of user activity logs by security analysts.
   • BMonitor only privileged user activity, as they pose the greatest risk.
   • CImplement user and entity behavior analytics (UEBA) that establishes baselines and alerts on anomalous behavior.
   • DRely on rule-based alerts that trigger on specific known malicious actions.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A financial institution is updating its incident response plan. The plan must clearly define who is authorized to make critical decisions during a security incident, such as shutting down systems or notifying law enforcement. The organization wants to ensure that during a high-pressure incident, there is no ambiguity about decision-making authority. What should the plan specify?

   • AThat all decisions must be made by consensus of the entire incident response team.
   • BA clear chain of command with designated roles and delegated authority for specific incident types.
   • CThat any team member can make decisions if they feel it is necessary.
   • DThat the legal department must approve all actions before they are taken.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key consideration when developing secure maintenance procedures?

   • AEnsuring that all maintenance is performed remotely to reduce physical access risks
   • BEnsuring that maintenance is performed without any documentation
   • CEnsuring that maintenance personnel have the necessary access and authorization to perform their tasks
   • DEnsuring that maintenance is performed only during business hours
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An organization's incident response plan is being updated. The plan must address ransomware incidents, which often involve both technical response and legal/regulatory obligations. The organization wants to ensure that the response is coordinated and that evidence is preserved for potential legal action. What should the plan include?

   • AA policy that the organization will pay the ransom to resolve incidents quickly.
   • BA requirement that all ransomware incidents be reported to law enforcement before any technical response.
   • CA technical response team that focuses solely on eradicating the ransomware and restoring systems.
   • DA coordinated response team that includes IT, legal, and communications, with procedures for evidence preservation and chain of custody.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government agency is required to maintain continuous monitoring of its information systems. The agency's security team has limited resources and cannot monitor all systems at the same frequency. The agency must prioritize monitoring efforts based on risk. Which approach best aligns with continuous monitoring design principles?

   • AMonitor all systems at the same frequency to ensure equal coverage.
   • BImplement a risk-based monitoring strategy that focuses on high-impact systems and adjusts monitoring frequency based on changes in risk.
   • CMonitor only systems that have experienced past security incidents.
   • DDecrease monitoring frequency for all systems to save resources.
   Reveal Solution Discussion Select an answer first