1. Which of the following is a common method of encrypting data in
transit?
A. RSA encryption
B. AES encryption
C. TLS (Transport Layer Security)
D. SHA-256 hashing
Answer: C) TLS (Transport Layer Security)
Rationale: TLS is widely used for encrypting data in transit, ensuring
secure communication between systems, such as between a web server
and a browser.
2. What does 'least privilege' mean in the context of security
operations?
A. Only allowing access to the most critical data and systems
B. Restricting users’ access to only the resources necessary for their
tasks
C. Allowing users to access all resources to improve efficiency
D. Granting full administrative rights to all employees
Answer: B) Restricting users’ access to only the resources necessary for
their tasks
,Rationale: The principle of least privilege ensures that users are
granted the minimum level of access necessary to perform their job
functions, reducing the risk of accidental or malicious misuse of
resources.
3. What is the primary goal of a Disaster Recovery (DR) plan in the
context of security operations?
A. To prevent security breaches from happening
B. To recover systems and data after an attack or disaster
C. To monitor ongoing security incidents in real time
D. To conduct regular vulnerability scans on critical systems
Answer: B) To recover systems and data after an attack or disaster
Rationale: A Disaster Recovery plan focuses on restoring systems and
data to normal operations after a disaster or attack, ensuring business
continuity.
4. Which of the following is most likely to be a key performance
indicator (KPI) in a security operations center?
A. Number of malware infections detected
B. Time taken to detect and respond to security incidents
C. Total amount of system uptime
D. Percentage of budget spent on security tools
Answer: B) Time taken to detect and respond to security incidents
, Rationale: KPIs in a SOC often focus on response times and the
effectiveness of incident handling, such as how quickly security
incidents are detected and resolved.
5. What is the purpose of network traffic analysis in security
operations?
A. To identify and block malicious activity on the network
B. To encrypt all data in transit across the network
C. To ensure compliance with network security policies
D. To identify potential vulnerabilities in network devices
Answer: A) To identify and block malicious activity on the network
Rationale: Network traffic analysis helps identify suspicious or
malicious activity in network communications, enabling security teams
to block or mitigate potential threats.
6. In which phase of the incident response lifecycle is evidence collected
and preserved?
A. Detection and Analysis
B. Containment, Eradication, and Recovery
C. Post-Incident Activity
D. Identification
Answer: A) Detection and Analysis
transit?
A. RSA encryption
B. AES encryption
C. TLS (Transport Layer Security)
D. SHA-256 hashing
Answer: C) TLS (Transport Layer Security)
Rationale: TLS is widely used for encrypting data in transit, ensuring
secure communication between systems, such as between a web server
and a browser.
2. What does 'least privilege' mean in the context of security
operations?
A. Only allowing access to the most critical data and systems
B. Restricting users’ access to only the resources necessary for their
tasks
C. Allowing users to access all resources to improve efficiency
D. Granting full administrative rights to all employees
Answer: B) Restricting users’ access to only the resources necessary for
their tasks
,Rationale: The principle of least privilege ensures that users are
granted the minimum level of access necessary to perform their job
functions, reducing the risk of accidental or malicious misuse of
resources.
3. What is the primary goal of a Disaster Recovery (DR) plan in the
context of security operations?
A. To prevent security breaches from happening
B. To recover systems and data after an attack or disaster
C. To monitor ongoing security incidents in real time
D. To conduct regular vulnerability scans on critical systems
Answer: B) To recover systems and data after an attack or disaster
Rationale: A Disaster Recovery plan focuses on restoring systems and
data to normal operations after a disaster or attack, ensuring business
continuity.
4. Which of the following is most likely to be a key performance
indicator (KPI) in a security operations center?
A. Number of malware infections detected
B. Time taken to detect and respond to security incidents
C. Total amount of system uptime
D. Percentage of budget spent on security tools
Answer: B) Time taken to detect and respond to security incidents
, Rationale: KPIs in a SOC often focus on response times and the
effectiveness of incident handling, such as how quickly security
incidents are detected and resolved.
5. What is the purpose of network traffic analysis in security
operations?
A. To identify and block malicious activity on the network
B. To encrypt all data in transit across the network
C. To ensure compliance with network security policies
D. To identify potential vulnerabilities in network devices
Answer: A) To identify and block malicious activity on the network
Rationale: Network traffic analysis helps identify suspicious or
malicious activity in network communications, enabling security teams
to block or mitigate potential threats.
6. In which phase of the incident response lifecycle is evidence collected
and preserved?
A. Detection and Analysis
B. Containment, Eradication, and Recovery
C. Post-Incident Activity
D. Identification
Answer: A) Detection and Analysis
