CISSP Security Operations: 156 practice questions

12 of the 156 Security Operations questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. The inline device blocked matching traffic: Which statement best interprets this record?

1. Both devices provided identical prevention because each generated alerts.

   Alert generation is common to both, but passive observation does not demonstrate inline blocking capability.
2. The inline device only monitored traffic because prevention requires endpoint installation.

   An inline network device can enforce matching rules without requiring installation on endpoints.
3. The passive sensor proves the gateway is protected against all malicious traffic.

   One detected event cannot establish comprehensive protection against other traffic or attack techniques.
4. The inline device blocked matching traffic, while the passive sensor detected without enforcement. ✓

   Inline IPS placement permits blocking, whereas passive IDS placement observes traffic and produces alerts.

The record demonstrates prevention by the inline IPS and detection-only behavior from the passive IDS sensor.

2. Enforce two-person approval for each HSM signing operation: Which control directly prevents the demonstrated u

1. Enforce two-person approval for each HSM signing operation. ✓

   Requiring two independent approvals before execution directly enforces the stated policy and prevents solitary authorization.
2. Record both administrators in the audit log.

   Logging provides accountability but does not prevent solitary retrieval or use.
3. Split backup key material between two recovery custodians.

   Dividing recovery material does not impose a second approval on use of the existing online HSM key.
4. Require both administrators to use longer passwords.

   Stronger passwords do not prevent one administrator from possessing and using the complete key.

Enforce dual control on each signing operation rather than relying on observation or divided backup custody.

3. Interlock normal access: Which design resolves the conflict?

1. Require security personnel to release the interlock when an evacuation begins.

   Personnel-dependent release can delay evacuation and is unnecessary because the requirement calls for immediate egress.
2. Use a timed interlock that releases both doors after a short delay.

   A delay still conflicts with the requirement for immediate emergency egress, and simultaneous release weakens the normal control.
3. Interlock normal access; emergency egress overrides it. ✓

   The interlock prevents simultaneous normal access, while the emergency override preserves immediate evacuation.
4. Remove the interlock and rely on guards, cameras, and visitor awareness to discourage tailgating.

   This abandons the stated technical anti-tailgating requirement and substitutes less direct measures without resolving the conflict.

Use the interlock normally and override it for immediate emergency egress.

4. The exercise assessed planning and communications: The team documented two communication gaps.” Which conclusi

1. The documented gaps show that backup restoration failed during execution.

   The exercise did not restore backups; communication findings do not establish a failed restoration attempt.
2. The exercise confirmed that the recovery priorities were technically achievable.

   Discussing priorities does not validate the technical ability to restore systems or meet recovery targets.
3. The exercise demonstrated alternate-site readiness, backup restorability, and achievement of the recovery time objective.

   None of those capabilities was demonstrated because no restoration, failover, alternate processing, or timed recovery occurred.
4. The exercise assessed planning and communications, but did not prove operational recovery capability. ✓

   The record supports conclusions about planning and communications; without restoration, failover, or alternate processing, operational recovery remains unverified.

The tabletop assessed planning and communications, not operational recovery, restoration, or alternate processing.

5. Use the authorized emergency procedure: What is the best approach under this constraint?

1. Test and deploy the change in production first, then seek the emergency authority’s approval if the service remains available.

   This reverses the required authorization sequence and provides no stated rollback or communication controls before implementation.
2. Apply the fix now and document it afterward.

   Urgency does not permit bypassing required authorization, rollback planning, and communication.
3. Wait for the next standard change meeting.

   Waiting ignores the approved emergency path despite active exploitation and urgent exposure.
4. Use the authorized emergency procedure, including rollback criteria, communication, and later review. ✓

   The approved path reduces urgent risk while preserving authorization, reversibility, communication, and accountability.

Use the authorized emergency process with rollback, communication, and retrospective review.

6. Trigger the duress alarm and keep the interlock active: What should the operator do?

1. Disable the interlock temporarily to prevent confrontation, then report the threat to security.

   Disabling the safety control increases operational danger and yields to coercion instead of using the authorized duress response.
2. Ask the supervisor to move away from the controls before activating the alarm.

   This delays the authorized response and may expose the operator to further coercion or violence.
3. Notify the next shift and document the threat for later review.

   Delayed reporting leaves an immediate credible threat unmanaged despite an available authorized response.
4. Trigger the duress alarm and keep the interlock active. ✓

   This promptly invokes the authorized protective response while preserving the safety control.

Activate the authorized duress response while leaving the safety interlock engaged.

7. Set backup frequency at least every fifteen minutes: Which action best resolves the conflicting requirements?

1. Replace backups with synchronous replication to satisfy the recovery point requirement automatically.

   Replication may reproduce corruption or deletion and does not replace isolated, tested backup capability.
2. Set backup frequency at least every fifteen minutes, then test restoration and capacity. ✓

   A 15-minute RPO requires backup intervals no longer than fifteen minutes, with restoration usability verified.
3. Retain nightly backups because the general policy applies enterprise-wide.

   Nightly backups permit substantially more data loss than the checkout process’s approved recovery point objective.
4. Approve hourly backups because they improve recovery without changing the existing policy.

   Hourly backups improve protection but still exceed the stated 15-minute tolerable data-loss interval.

The approved RPO requires backup intervals of fifteen minutes or less, followed by restoration testing.

8. Assign custodians: Which custody approach best satisfies the constraint while preserving accountability?

1. Encrypt the drives and let any available employee transport them.

   Encryption protects data content but unrestricted transport obscures responsibility and physical custody changes.
2. Hold the drives centrally until every field office can send its media in one consolidated shipment.

   Central holding delays scheduled processing and does not provide controlled custody for the eventual shipment.
3. Use ordinary courier packaging and record only shipment dates.

   Shipment dates do not establish possession, tamper evidence, or responsibility during each custody change.
4. Assign custodians, use tamper-evident containers, and obtain signatures at each transfer. ✓

   Named custodians, tamper evidence, and signed transfer records preserve accountability while keeping the drives available for processing.

Use authorized custodians, tamper evidence, and signed transfer records.

9. Isolate the exploited gateway from attack paths while: Which control should receive priority?

1. Document both vulnerabilities and wait for scheduled maintenance to compare their scores.

   Waiting leaves a confirmed active attack path open despite authorized emergency change capability.
2. Patch the laboratory server first because its CVSS score is higher.

   CVSS severity does not outweigh demonstrated exploitation and exposure affecting a critical production gateway.
3. Isolate the exploited gateway from attack paths while preserving evidence where feasible. ✓

   Active exploitation and internet exposure demonstrate immediate risk requiring containment beyond severity ranking alone.
4. Purchase cyber insurance before changing either vulnerable system’s configuration.

   Insurance may transfer financial risk but does not remove active exposure or remediate technical weakness.

Demonstrated exploitation and internet exposure make containment the immediate priority over severity alone.

10. Investigate the four unexplained differences against: What is the most appropriate conclusion?

1. Close the issue because approved changes explain some configuration differences.

   Partial explanation leaves four differences unaccounted for and potentially unauthorized or erroneous.
2. Investigate the four unexplained differences against change records and system owners. ✓

   The unexplained differences require validation because approval records account for only four deviations.
3. The baseline is invalid because any configuration difference disproves its usefulness.

   A baseline remains useful when differences are evaluated against approved changes and runtime evidence.
4. The server has eight unauthorized changes requiring immediate rollback.

   Four differences have documented authorization, so the record does not establish that all eight are unauthorized.

Four configuration differences remain unexplained and require investigation, not automatic rollback or closure.

11. The continuity director: Who should formally declare the disaster?

1. The continuity director, using the threshold and the manager’s recommendation. ✓

   The plan assigns formal declaration authority to the continuity director after receiving the relevant operational facts.
2. The technician, because technical facts justify immediate action.

   Technical expertise informs the decision but does not grant the authority assigned by the plan.
3. The facility manager, because the threshold was exceeded and the failure requires immediate operational intervention.

   The manager may recommend activation but lacks authority for the formal declaration.
4. The insurer, because the declaration may affect recovery financing.

   Insurance involvement does not transfer organizational authority for continuity activation.

The continuity plan assigns formal disaster declaration authority to the continuity director.

12. Activate the approved paper downtime procedures and assign: Which TWO actions should the incident coordinator

Select two. More than one option is correct — every correct one is ticked below.

1. Activate the approved paper downtime procedures and assign staff to maintain them. ✓

   Approved manual procedures preserve essential operations when the primary system is unavailable.
2. Wait for the vendor to restore the platform before supporting essential manual care.

   The approved workaround exists specifically to sustain critical processes during the outage.
3. Reconcile and validate manual records against restored electronic records before normal closure. ✓

   Post-restoration reconciliation prevents omissions, duplicates, and unsafe discrepancies from remaining unresolved.
4. Resume electronic entry immediately after access returns, without checking paper records.

   Skipping reconciliation can leave missing, duplicated, or inconsistent patient information after restoration.
5. Create an improvised spreadsheet without documenting its approval or ownership.

   An improvised record may introduce inconsistent handling and lacks the plan’s required accountability.

Use the approved manual workaround during the outage, then reconcile and validate records after restoration.

Other CISSP domains

• Security and Risk Management — 192 questions →
• Security Architecture and Engineering — 156 questions →
• Communication and Network Security — 156 questions →
• Identity and Access Management (IAM) — 156 questions →
• Security Assessment and Testing — 144 questions →
• All 1200 CISSP questions →
• CISSP certification: requirements, cost and exam format →