Home › Certifications › CISSP › Security Operations
48 multiple-choice questions and 43 flashcards on Security Operations, about 13% of the CISSP bank. Every one carries a written rationale.
Security Operations is one of 8 chapters in CoStudy's CISSP bank, and it holds 48 of the bank's 375 multiple-choice questions — roughly 13% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
5 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
Which BEST describes a SIEM's PRIMARY value compared to log aggregation alone?
Answer: A — Real-time correlation and alerting analytics across diverse log sources
A) Correct: Aggregation only collects; a SIEM normalizes and correlates events across sources against rules and baselines to raise actionable alerts. B) Ingestion-based licensing usually makes a SIEM the more expensive store. C) Endpoint telemetry still requires EDR. D) Analyst judgement remains essential to triage.
Which BEST describes the principle of least privilege?
Answer: E — Subjects hold only the permissions their function needs
E is the definition: a user, process, or service holds the minimum permissions required to perform its function, and nothing further, which bounds the damage from any compromised account. A and C are the common real-world violations, granting rights by convenience or seniority rather than need. B removes the tailoring that makes the principle work. D confuses privilege minimization with credential rotation. Least privilege pairs with need-to-know for data and separation of duties for processes.
A threat intelligence program currently consumes only IP and hash indicator feeds. Management asks why detections keep going stale within days. The MOST accurate explanation is that the program lacks:
Answer: C — Adversary tactics, techniques and procedures, which change far more slowly
C) Correct — atomic indicators sit at the bottom of the pyramid of pain and are trivially rotated; detections built on TTPs describe how the adversary must operate and therefore survive infrastructure churn. A) Adding feeds multiplies the same short-lived artifacts and increases noise rather than durability. B) Faster deployment shortens the lag but the indicator still expires quickly. D) Confidence scoring and aging improve hygiene, addressing the symptom of stale data rather than the absence of behavioral detection.
A privileged access management program is being designed for third-party support engineers. Which combination BEST balances accountability with operational need?
Answer: A — Just-in-time elevation to named accounts with session recording and expiry
A) Correct — time-bounded elevation tied to a named identity preserves individual accountability, and recording plus automatic expiry ensures the entitlement does not outlive the task. B) Shared accounts destroy attribution no matter how quickly the password is rotated afterward. C) Restricting where rights are used is helpful, but standing domain administrator privilege for external staff is the excess the program exists to remove. D) Long-lived checkout reintroduces standing privilege and defeats the purpose of vaulting.
An organization's BCP designates a hot site, a warm site and a cold site. Which factor PRIMARILY drives the choice between them?
Answer: A — The Recovery Time Objective of the critical business processes the site is intended to restore
A) Correct: site type is chosen to meet the recovery time objective — a hot site supports near-immediate resumption, a warm site hours, a cold site days or weeks, with cost rising as RTO falls. B) Distance matters for regional-disaster separation and staff travel, but it is a siting decision independent of readiness level. C) Headcount determines how large the facility must be, not how ready it must be. D) Data classification drives the controls applied at the site rather than its recovery posture.
4 cards from the 43 in this chapter.
What is the difference between a tabletop exercise and a full simulation?
Tabletop: discussion-based walk-through, low cost, common. Simulation: actual execution under realistic conditions. Plus parallel test, full interruption test.
What is the order of incident response actions for ransomware?
Detect → Isolate (network containment) → Triage scope → Eradicate (remove persistence) → Restore from clean backups → Investigate root cause → Lessons learned. Don't pay if avoidable.
What is the importance of testing backups?
An untested backup is not a backup — restore tests verify integrity, completeness, and procedures. Schedule periodic drills + automated integrity checks.
What is the principle of least privilege?
Grant only the minimum permissions necessary to perform a function. Reduces blast radius from compromise or mistakes.
These are a sample. The full Security Operations chapter runs 91 items with per-chapter progress tracking, on the web and in the iOS app.