01
Choose one
1 point
A workload’s local logs may be altered during an attack. What is a key reason to send security events to a protected central log store?
Free Practice Quiz Question List
7 Security Operations and Incident Readiness Online Quiz Questions
Use this free practice quiz with 20 questions to review 7 Security Operations and Incident Readiness, test your knowledge, and prepare for your next test or exam.
20 questions
02
Choose one
1 point
Which event pattern best illustrates a context-aware detection that could warrant investigation?
- A
A privileged account signs in from an unusual context and then changes access policies.
- B
A single routine event occurs without any unusual context.
- C
A system produces a log entry that matches expected behavior.
- D
A monitoring rule alerts on every event from every asset.
03
Choose one
1 point
Two systems have the same critical vulnerability. One is an internet-facing identity service, while the other is an isolated test host. Which prioritization decision best reflects system risk?
- A
Treat every weakness with the same severity score identically.
- B
Delay action until a routine scan is repeated, regardless of exposure.
- C
Prioritize the internet-facing identity service because it is reachable and important.
- D
Prioritize only by the age of the affected software.
04
Choose one
1 point
A team wants to know whether its monitoring has gaps before an incident occurs. Which practice best addresses that goal?
- A
Assume monitoring works whenever a detection rule exists.
- B
Review only the number of alerts generated each day.
- C
Replace source health checks with more detection rules.
- D
Track reporting from expected sources, ingestion delays, and storage or processing errors.
05
Choose all
1 point
Select all log details that help analysts interpret and correlate security events while avoiding unnecessary secrets.
- A
Consistent timestamps
- B
Passwords and authentication tokens
- C
Stable actor and resource identifiers
- D
Unrelated personal details collected for completeness
- E
Event outcomes and enough context to interpret activity
06
Choose all
1 point
Select all measures that help make incident response actionable before an incident occurs.
- A
Define who can declare and lead an incident.
- B
Clarify who can authorize containment.
- C
Assume normal identity and communications services will always be available.
- D
Ensure responders can reach relevant logs and asset information during failures of normal services.
- E
Wait until an incident to decide how evidence will be preserved.
07
True or false
1 point
True or false: Incident response should be integrated with broader cybersecurity risk management rather than treated as a separate activity.
- A
True
- B
False
08
True or false
1 point
True or false: A single vulnerability scan is enough to complete vulnerability management for a system.
- A
True
- B
False
09
Written response
1 point
Which component should be synchronized to a common time source so events from different systems can be correlated?
10
Written response
1 point
Name one type of secret that should not be recorded in logs. Enter the two-word example identified in the material.
11
Fill in the blank
1 point
To support reliable event correlation, record consistent and stable actor and resource identifiers.
12
Fill in the blank
1 point
When prioritizing a weakness, consider whether it is being , as well as reachability, asset importance, and existing safeguards.
13
Open ended
1 point
A service is being designed, and its teams have not yet set logging requirements. Describe how they should decide what to log and how to protect and manage those logs.
14
True or false
1 point
True or false: Incident response should be treated as separate from an organization’s broader cybersecurity risk management.
- A
True
- B
False
15
Written response
1 point
What should be synchronized to a common time source so that events from different systems can be interpreted and correlated?
16
Written response
1 point
What are safeguards called when they are used as an alternative measure to help address vulnerability risk?
17
Choose one
1 point
A team is defining logging requirements for an important security event. Which set of decisions best fits the recommended approach?
- A
Which software product will analyze every event and automatically decide whether it is malicious
- B
What must be recorded, where it is sent, who may access it, and how long it is retained
- C
Only the event’s severity score and the name of the system administrator
- D
The maximum number of events each application may produce per day
18
Choose one
1 point
A compromised server’s local logs may be altered during an attack. What is a key benefit of sending its logs to a protected central store?
- A
It eliminates the need to restrict access to logs
- B
It makes system clocks unnecessary because analysts can infer event order
- C
It can preserve evidence even if an affected system’s local logs are altered or lost
- D
It guarantees that every alert is accurate without investigation
19
Choose one
1 point
A security team wants to verify that its monitoring capability is functioning, not just review the alerts it produces. Which check is most appropriate?
- A
Check whether expected sources report, ingestion is delayed, or storage and processing problems threaten coverage
- B
Generate an alert for every isolated event, regardless of context
- C
Replace detection testing with a review of asset ownership alone
- D
Assume coverage is intact whenever the monitoring platform is available
20
Choose one
1 point
The same critical vulnerability affects an internet-facing identity service and an isolated test host. Which prioritization decision best reflects a risk-based approach?
- A
Treat the vulnerability with the higher severity score first in every case
- B
Prioritize the internet-facing identity service because its reachability and importance increase the risk
- C
Prioritize the isolated test host because test systems always carry greater risk
- D
Delay both until the next routine scan, since prioritization is based only on scan frequency