Domain 5: Security Operations and Incident Response

Data security, system hardening, security policies, and security awareness training.

5 minutes 5 Questions

Domain 5: Security Operations is a critical component of the ISC2 Certified in Cybersecurity (CC) certification, focusing on the day-to-day practices and procedures necessary to protect organizational assets and maintain a secure environment. This domain covers several key areas: **Data Security:…

Concepts covered
Hashing AlgorithmsData Classification and LabelingData Destruction and SanitizationSystem Hardening and BaselinesIncident Response PlanningChange Management PolicyIncident Response LifecyclePassword Policies and Best PracticesIncident Detection and ReportingIncident Containment and EradicationLessons Learned and Post-Incident ReviewSecurity Event Logging and MonitoringData Handling and Retention PoliciesSymmetric EncryptionAsymmetric EncryptionConfiguration Management and Patch ManagementAcceptable Use and BYOD PoliciesPrivacy Policy FundamentalsThreat Actors and Cyber Threat IntelligenceThreat Frameworks (MITRE ATT&CK, Cyber Kill Chain)Security Event Triage and PrioritizationIncident Response Exercises and TabletopsSecurity Testing: Red, Blue, and Purple TeamingAsset Lifecycle Management and EOLQuantum-Resistant Cryptography Concepts
Test mode:
Start practice test

CC - Domain 5: Security Operations and Incident Response Example Questions

Test your knowledge of Domain 5: Security Operations and Incident Response

Question 1

A technician is tasked with disposing of old hard drives that stored employee payroll data. After performing a sanitization method, the technician wants to confirm the data cannot be recovered. Which action best verifies that the sanitization was effective?

Correct Answer: Attempt data recovery on a sample of the sanitized drives using forensic tools

Attempting data recovery using forensic tools on a sample of sanitized drives is the best verification method because it directly tests whether the data can actually be recovered, providing empirical proof that the sanitization was effective.

Reviewing software logs only confirms the process ran but does not prove data is unrecoverable. Running a disk check utility merely shows the drive reports no used space, which does not mean data cannot be recovered with specialized tools. Documenting serial numbers and updating inventory is an administrative task related to asset tracking, not a verification of data destruction.

The key concept tested is verification of data sanitization effectiveness through independent testing.

Question 2

What does patch management primarily involve?

Correct Answer: Identifying, testing, and applying software updates to fix vulnerabilities

Patch management primarily involves identifying, testing, and applying software updates (patches) to fix known vulnerabilities and security flaws in operating systems and applications.

Monitoring network traffic and analyzing performance relates to network management and performance monitoring, not patch management. Tracking hardware inventory is part of asset management, not patch management. Deploying new software applications describes software deployment or release management, which is distinct from patching existing software to address vulnerabilities.

The key concept tested is understanding that patch management is a critical security practice focused on keeping software current by remediating known vulnerabilities through systematic updates.

Question 3

A new employee notices their computer displaying an unfamiliar pop-up message asking for login credentials. The pop-up looks slightly different from the usual company login screen. What should the employee do first?

Correct Answer: Report the suspicious pop-up to the IT helpdesk or security team

Reporting the suspicious pop-up to the IT helpdesk or security team is the correct first action because it follows proper incident reporting procedures and allows trained professionals to investigate and respond to a potential phishing or malware attack.

Entering credentials would potentially compromise the account if the pop-up is malicious. Simply closing the pop-up and continuing to work ignores a potential security threat and fails to alert the organization. Taking a screenshot and testing with an old password still involves entering credentials into a potentially malicious interface, which could expose information to an attacker.

The key concept tested is security incident reporting and recognizing social engineering indicators.

More Domain 5: Security Operations and Incident Response questions
1047 questions (total)
Practice 100 questions
One session at a time, always new questions