CISSP SECURITY OPERATIONS PRACTICE EXAMINATION | STUDY
GUIDE | LATEST UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100% CORRECT
ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for information security professionals
preparing for Domain 7 of the CISSP certification: Security Operations. This domain
encompasses the management and execution of security operations including incident response,
investigations, monitoring, logging, disaster recovery, and business continuity operations. Each
question has been developed to reflect the cognitive complexity of the adaptive testing
environment, challenging candidates with advanced scenarios involving digital forensics,
incident management, security monitoring, and operational resilience. By working through these
100 advanced questions with detailed answer rationales and verified solutions, you will
systematically identify knowledge gaps and strengthen your command of security operations
principles essential for passing the CISSP examination.
Table of Contents
Incident Response and Management
Digital Forensics and Evidence Handling
Security Monitoring and Log Management
Disaster Recovery and Business Continuity Operations
Physical Security Operations
Malware Analysis and Threat Intelligence
Change and Configuration Management
Operational Resilience and Redundancy
,Question 1
A security operations center analyst receives an alert indicating that a workstation is
communicating with a known command-and-control server over DNS. The traffic consists of
TXT record queries for subdomains that appear to contain base64-encoded data. The analyst
confirms the host is compromised. What should be the first containment action?
A) Immediately reimage the compromised workstation
B) Sinkhole the malicious domain at the internal DNS resolver to disrupt the C2 channel and
identify other affected hosts
C) Block all outbound DNS traffic from the entire network
D) Shut down the compromised workstation immediately
Correct Answer: B
DNS sinkholing disrupts the attacker's command and control channel while preserving evidence
for investigation. The sinkhole can log which other internal hosts attempt to resolve the
malicious domain, revealing the scope of compromise. Reimaging destroys forensic evidence.
Blocking all DNS disrupts business operations. Immediate shutdown may trigger destructive
actions by the malware and also destroys volatile evidence.
Question 2
During a forensic investigation of a compromised Linux server, the investigator acquires a
memory image. The server was running full disk encryption with LUKS. The incident response
team does not have the escrowed master key. What is the most critical reason to acquire the
memory image before powering down the system?
A) To preserve the running process list
,B) To capture the LUKS master key that resides in RAM, which is necessary to decrypt the disk
image for forensic analysis
C) To document the system uptime
D) To preserve network connections
Correct Answer: B
With full disk encryption, pulling power renders the disk data irrevocably encrypted without the
key. The LUKS master key is resident in RAM during operation. Live memory acquisition
captures this key, enabling subsequent decryption of the forensic disk image. Process lists and
network connections are also valuable but secondary to the ability to access the encrypted data.
Question 3
A security analyst is investigating a potential data exfiltration incident. The suspect used a cloud
storage service to upload files from a corporate laptop. The laptop has full disk encryption
enabled. The analyst has a warrant to examine the laptop. What forensic artifact on the laptop
might contain evidence of recently accessed cloud files, even if the files are no longer stored
locally?
A) The laptop's BIOS settings
B) Windows Registry shellbags, LNK files in the Recent Items folder, and prefetch files
C) The laptop's hardware diagnostic logs
D) The encryption key stored in the TPM
Correct Answer: B
Windows maintains extensive records of user activity. Shellbags track folder access and view
settings. LNK (shortcut) files in the Recent Items folder contain full paths to accessed files,
including cloud-synced paths, timestamps, and volume serial numbers. Prefetch files record
, application execution. These artifacts persist even after the original files are deleted. The TPM
stores encryption keys, not file access history.
Question 4
An organization's incident response playbook for ransomware includes an immediate step to
isolate affected systems. The network engineer applies an ACL on the distribution switch to
block all outbound SMB traffic from the affected subnet. However, the malware continues to
beacon out to its C2 server via HTTPS on port 443. What is the deficiency in this containment
action?
A) The ACL was applied in the wrong direction
B) Blocking SMB prevents lateral movement but fails to sever the command and control channel
over HTTPS, allowing the attacker to maintain control
C) The ACL blocks backup replication jobs that also use SMB
D) The ACL lacks a deny-all implicit rule
Correct Answer: B
Containment requires severing the attacker's control and preventing both lateral movement and
C2 communication. Blocking only SMB addresses lateral movement but leaves the HTTPS C2
channel intact. The attacker can still receive commands and potentially exfiltrate data. Effective
containment must address all identified malicious communication channels. The host should also
be isolated at the network level.
Question 5
A digital forensics investigator acquires a suspect's iPhone. The device is powered on, connected
to a cellular network, and locked with an unknown passcode. The device uses a Secure Enclave
and is configured to erase after 10 failed passcode attempts. What is the most forensically sound
GUIDE | LATEST UPDATE 2026/2027 | ACTUAL EXAM | PRACTICE
QUESTIONS AND ANSWERS | EXAM REVIEW | 100% CORRECT
ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for information security professionals
preparing for Domain 7 of the CISSP certification: Security Operations. This domain
encompasses the management and execution of security operations including incident response,
investigations, monitoring, logging, disaster recovery, and business continuity operations. Each
question has been developed to reflect the cognitive complexity of the adaptive testing
environment, challenging candidates with advanced scenarios involving digital forensics,
incident management, security monitoring, and operational resilience. By working through these
100 advanced questions with detailed answer rationales and verified solutions, you will
systematically identify knowledge gaps and strengthen your command of security operations
principles essential for passing the CISSP examination.
Table of Contents
Incident Response and Management
Digital Forensics and Evidence Handling
Security Monitoring and Log Management
Disaster Recovery and Business Continuity Operations
Physical Security Operations
Malware Analysis and Threat Intelligence
Change and Configuration Management
Operational Resilience and Redundancy
,Question 1
A security operations center analyst receives an alert indicating that a workstation is
communicating with a known command-and-control server over DNS. The traffic consists of
TXT record queries for subdomains that appear to contain base64-encoded data. The analyst
confirms the host is compromised. What should be the first containment action?
A) Immediately reimage the compromised workstation
B) Sinkhole the malicious domain at the internal DNS resolver to disrupt the C2 channel and
identify other affected hosts
C) Block all outbound DNS traffic from the entire network
D) Shut down the compromised workstation immediately
Correct Answer: B
DNS sinkholing disrupts the attacker's command and control channel while preserving evidence
for investigation. The sinkhole can log which other internal hosts attempt to resolve the
malicious domain, revealing the scope of compromise. Reimaging destroys forensic evidence.
Blocking all DNS disrupts business operations. Immediate shutdown may trigger destructive
actions by the malware and also destroys volatile evidence.
Question 2
During a forensic investigation of a compromised Linux server, the investigator acquires a
memory image. The server was running full disk encryption with LUKS. The incident response
team does not have the escrowed master key. What is the most critical reason to acquire the
memory image before powering down the system?
A) To preserve the running process list
,B) To capture the LUKS master key that resides in RAM, which is necessary to decrypt the disk
image for forensic analysis
C) To document the system uptime
D) To preserve network connections
Correct Answer: B
With full disk encryption, pulling power renders the disk data irrevocably encrypted without the
key. The LUKS master key is resident in RAM during operation. Live memory acquisition
captures this key, enabling subsequent decryption of the forensic disk image. Process lists and
network connections are also valuable but secondary to the ability to access the encrypted data.
Question 3
A security analyst is investigating a potential data exfiltration incident. The suspect used a cloud
storage service to upload files from a corporate laptop. The laptop has full disk encryption
enabled. The analyst has a warrant to examine the laptop. What forensic artifact on the laptop
might contain evidence of recently accessed cloud files, even if the files are no longer stored
locally?
A) The laptop's BIOS settings
B) Windows Registry shellbags, LNK files in the Recent Items folder, and prefetch files
C) The laptop's hardware diagnostic logs
D) The encryption key stored in the TPM
Correct Answer: B
Windows maintains extensive records of user activity. Shellbags track folder access and view
settings. LNK (shortcut) files in the Recent Items folder contain full paths to accessed files,
including cloud-synced paths, timestamps, and volume serial numbers. Prefetch files record
, application execution. These artifacts persist even after the original files are deleted. The TPM
stores encryption keys, not file access history.
Question 4
An organization's incident response playbook for ransomware includes an immediate step to
isolate affected systems. The network engineer applies an ACL on the distribution switch to
block all outbound SMB traffic from the affected subnet. However, the malware continues to
beacon out to its C2 server via HTTPS on port 443. What is the deficiency in this containment
action?
A) The ACL was applied in the wrong direction
B) Blocking SMB prevents lateral movement but fails to sever the command and control channel
over HTTPS, allowing the attacker to maintain control
C) The ACL blocks backup replication jobs that also use SMB
D) The ACL lacks a deny-all implicit rule
Correct Answer: B
Containment requires severing the attacker's control and preventing both lateral movement and
C2 communication. Blocking only SMB addresses lateral movement but leaves the HTTPS C2
channel intact. The attacker can still receive commands and potentially exfiltrate data. Effective
containment must address all identified malicious communication channels. The host should also
be isolated at the network level.
Question 5
A digital forensics investigator acquires a suspect's iPhone. The device is powered on, connected
to a cellular network, and locked with an unknown passcode. The device uses a Secure Enclave
and is configured to erase after 10 failed passcode attempts. What is the most forensically sound
