Security Operations

CISSP · 39 questions

• After a suspected insider leak of permit-office records, investigators seize a clerk's laptop and relevant log exports. What practice is essential for those materials?
• A municipal investigation into stolen case-management data may involve desktops, network captures, and city-issued phones. What approach best reflects sound digital forensics practice?
• HR and legal counsel request a report after an investigation into misuse of a library-patron database. What quality should that investigation report emphasize?
• A city's SOC wants better visibility across utility SCADA jump hosts, ERP, and public web apps. What logging approach best supports monitoring and actionable alerting?
• County network defenders deploy intrusion detection and prevention for traffic to citizen-services portals. What operational practice is most important after install?
• Analysts notice a clerk account querying property-tax records at 2 a.m. from an unusual location. Which monitoring mix best helps confirm anomalous insider-style behavior?
• A utility security team worries about sensitive GIS exports leaving the network. What monitoring emphasis best addresses that risk while staying effective over time?
• Firewall and server configurations for a city DMZ keep drifting from the approved build. What configuration-management approach best reduces that drift?
• Night-shift NOC operators for a transit network need console access to keep services running. How should their access be set?
• A county treasurer's office wants stronger day-to-day security operations around privileged work. Which control set best addresses conflicting duties and elevated accounts?
• Backup tapes holding court records travel by courier to an offsite vault. What media-protection practice is most appropriate in transit?
• Ransomware encrypts a public-works file share. Which sequence best reflects a complete incident management lifecycle response?
• A confirmed breach of a 311 call-center database may require notice beyond the SOC. What escalation practice is most appropriate?
• Citizens use a city permitting portal on the public internet. Which control set is most appropriate to operate for that exposure?
• A school-district SOC is choosing complementary host and deception controls beyond the firewall. Which mix is used appropriately?
• A mid-size city outsources after-hours monitoring to an MSSP and pilots ML-based anomaly detection. What oversight is most important?
• Water-treatment OT controllers and office laptops share a vulnerability management program. How should patching be handled?
• An emergency firewall change stops an active attack on a courts case-management VPN. What must still happen afterward, and what should normal changes require?
• Facing ransomware risk, a city plans backups for tax and utility billing systems. Which storage strategy is most thoughtful?
• A county 911 CAD system must resume within hours after a data-center outage, while a rarely used archive warehouse can wait days for space and hardware. Which recovery-site strategy best matches those two needs?
• After a flood closes City Hall’s primary data center, the emergency manager asks security to run the disaster recovery playbook end to end. Which set of activities best reflects implementing DR processes?
• A transit authority wants to validate its DR plan without cutting over live rider apps yet. Leadership also wants a later exercise that runs recovery systems in parallel with production. Which testing progression best fits?
• A city clerk’s office must keep issuing marriage licenses if the permit software is offline for a week. IT DR restores servers, but leadership asks security to join broader continuity work. What should that participation emphasize?
• A new civic records annex needs layered physical protection from the property line inward. Which control pairing best matches perimeter versus internal needs?
• County inspectors who travel to remote sites and clerks who handle cash both face personal-safety risks, including duress and MFA-fatigue social engineering. Which operational focus best addresses personnel safety and security?
• A library consortium’s SOC currently opens a few firewall logs when someone complains. Leadership wants continuous monitoring with measurable outcomes. What change best establishes that program?
• After containing a ransomware incident that hit a water-utility SCADA jump host, the city files a polished after-action PDF and shelves it. What should happen next for lessons learned to improve operations?
• A public-health clinic still runs FDA-cleared diagnostic devices that the vendor will not patch this year. Vulnerability scans keep flagging them. What is the most appropriate security-operations response?
• A city’s online building-permit system must keep issuing permits if the primary processing site fails. Leadership wants failover across sites with enough capacity. Which approach best meets that need?
• During a declared DR event for the county tax portal, who must receive timely, pre-planned communications and why does that matter operationally?
• A regulated municipal health-benefits system schedules a parallel DR test that may briefly affect reporting interfaces. What communications obligation should the test plan include?
• Compared with ordinary open-plan offices, how should a police evidence-storage room’s internal physical controls differ?
• Server administrators for a city’s identity directory currently share a standing admin password on a sticky note. Which privileged-account operations practice should replace that approach?
• Endpoint protection coverage across city departments is uneven, definitions are stale on many PCs, and detections often sit untriaged. What should anti-malware operations prioritize?
• Investigators believe a stolen city-issued phone holds messages relevant to a fraud case. What must guide collection of mobile-device artifacts?
• A change to open a database port from the Internet is headed to the city’s change advisory board without security review. Why should security participate in that CAB process?
• A DMV branch must still serve walk-in customers when the licensing software is down. Ops teams schedule drills for paper tickets and manual queues. What are these exercises primarily validating?
• Public-works employees have been posting photos of badge printers and server closets from inside restricted areas. What should personnel security awareness in operations emphasize?
• During a large public event, municipal networks experience congestion while emergency voice and video must stay usable for first responders. How does QoS support resilience here?