Free Practice Quiz Question List

6 Security Operations and Incident Response Online Quiz Questions

Use this free practice quiz with 20 questions to review 6 Security Operations and Incident Response, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: A recovery point objective (RPO) specifies the target maximum amount of data loss, measured in time.

A
True
B
False

Fill in the blank

1 point

A vulnerability is exploited before an effective patch is available. This is a vulnerability.

Choose one

1 point

An organization needs to correlate authentication events, endpoint activity, and cloud audit records to identify suspicious sequences. Which tool is designed for this role?

A
An EDR collects endpoint telemetry and supports endpoint investigation and response.
B
A SIEM centralizes and correlates events from multiple sources.
C
An IPS only records suspicious activity and cannot block or disrupt it.
D
A vulnerability scanner restores systems after a major disruption.

Choose one

1 point

A team creates a full backup on Sunday and a differential backup on Wednesday. Which data does the Wednesday differential backup contain?

A
It contains changes since the last backup of any type.
B
It contains a complete copy of all selected data each time.
C
It contains changes since the last full backup.
D
It contains only data stored on an off-site device.

Written response

1 point

A business impact analysis sets a target to restore a service within six hours after disruption. What is the RTO? Enter the value in hours.

True or false

1 point

True or false: A successful backup status message by itself proves that the organization can restore the data.

A
True
B
False

Fill in the blank

1 point

After containing an incident, responders remove malware and unauthorized persistence mechanisms. They are carrying out the phase.

Written response

1 point

What is the forensic term for the documented history of evidence possession and handling? Enter the term.

Choose all

1 point

Select all practices that support dependable security log management.

A
Use synchronized clocks and consistent timestamps, including a time zone or UTC.
B
Allow anyone with network access to change centralized logs without monitoring.
C
Restrict and monitor access to logs.
D
Retain logs according to business, legal, and regulatory needs.
E
Rely only on local logs because central copies cannot assist investigators.

Choose one

1 point

A severe vulnerability affects an isolated test machine. A moderately scored vulnerability is actively exploited on an internet-facing identity server. Which prioritization is best supported?

A
Fix the highest CVSS score first in every case, regardless of exposure or business impact.
B
Prioritize the actively exploited flaw on the exposed identity server, while considering business impact and available controls.
C
Defer the actively exploited flaw because its score is only moderate.
D
Treat both findings as equal because the test machine has a severe score.

Choose all

1 point

Responders confirm that an attacker has compromised an account and is communicating with an affected host. Select all actions that are examples of containment.

A
Isolate a compromised host from the network.
B
Return a restored system to normal operation without additional monitoring.
C
Disable a confirmed compromised account.
D
Block malicious traffic.
E
Remove persistence mechanisms from affected systems.

Choose one

1 point

During an investigation, a compromised host may contain relevant data in memory and running processes. What is the most appropriate forensic consideration before responders change the host's state?

A
Immediately shut down the host in every case, because volatile evidence is preserved after power is removed.
B
Begin analysis on the original system and document only the final conclusions.
C
Coordinate with incident leadership about collection priorities before taking actions that could destroy volatile evidence.
D
Ignore running processes because only stored files can support an investigation.

Open ended

1 point

An alert indicates possible account compromise and unauthorized access to a business system. Describe a practical incident-response approach from initial analysis through recovery and follow-up. Include how responders should handle evidence and why recovery should be monitored.

True or false

1 point

True or false: A successful backup message by itself proves that the backed-up data can be restored.

A
True
B
False

Choose one

1 point

A security team wants its SOAR platform to disable accounts confirmed as malicious. Which practice best supports safe automation?

A
Let the platform disable any account whenever an alert rule matches, without review or logging.
B
Require authorization and safeguards for response actions, and retain audit records of what the automation did.
C
Allow the platform to delete the alert and its supporting events after it takes action.
D
Use automation only to collect events, never to perform an approved response step.

Choose one

1 point

A network security system detects suspicious traffic and can block it. Which type of system has this blocking capability?

A
IDS
B
IPS
C
SIEM
D
EDR

Choose one

1 point

A business requires a service to be restored within six hours after a disruption. Which recovery measure expresses that target?

A
Recovery point objective (RPO)
B
Recovery time objective (RTO)
C
Business impact analysis (BIA)
D
Chain of custody

Written response

1 point

What is the term for the documented history of who possessed and handled digital evidence?

Choose one

1 point

An isolated test machine has a severe vulnerability. An internet-facing identity server has a moderately scored vulnerability that is actively exploited. Which finding should generally receive higher remediation priority?

A
Patch the isolated test machine first because its vulnerability has the higher severity score.
B
Prioritize the moderately scored flaw on the internet-facing identity server because it is actively exploited and affects an important exposed system.
C
Defer both findings until every vulnerability on the network has been assigned a score.
D
Close the identity-server finding because a moderate score means it cannot pose an urgent risk.

Written response

1 point

What term describes evidence such as memory contents and running processes that may disappear when a system is shut down?