Free Practice Quiz Question List

8 Security Operations and Incident Response Online Quiz Questions

Use this free practice quiz with 20 questions to review 8 Security Operations and Incident Response, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: In a safety-critical environment, responders should always isolate a potentially affected system immediately, without consulting system owners or considering operational hazards.

A
True
B
False

True or false

1 point

True or false: If a service is unavailable, restoring it from a backup is sufficient reason to reconnect the affected system before checking for the attacker's entry path or persistence.

A
True
B
False

Written response

1 point

What security approach says not to assume an account or device is safe merely because it is inside the organization's network?

Choose one

1 point

An unusual login alert is followed by access to sensitive files, but neither alert alone proves compromise. What is the best next step to assess whether this is a security incident?

A
Classify the first alert as a confirmed incident and begin recovery immediately.
B
Correlate relevant logs and assess whether the evidence meets the organization's criteria for an incident.
C
Close the alert because no single event can ever indicate an incident.
D
Notify every stakeholder that a confirmed compromise has occurred.

Fill in the blank

1 point

Restricting an account or device to only the access it needs applies the principle of .

Choose one

1 point

Responders confirm ongoing malicious activity on an ordinary employee workstation, with no safety-critical operation involved. Which action is an appropriate containment measure?

A
Leave it connected so its activity can continue to be observed without interruption.
B
Delete all files on the device before recording what happened.
C
Isolate the device from the network while responders investigate.
D
Reconnect it to a different network and wait for another alert.

Written response

1 point

What is the name for the record of who handled evidence, when they handled it, and why?

Choose all

1 point

Which actions support reliable evidence preservation during incident response? Select all that apply.

A
Preserve relevant logs and system data promptly because records may be overwritten.
B
Delay urgent containment until every possible item of evidence has been collected.
C
Record response actions and their times.
D
Allow unrestricted access to collected evidence so teams can work faster.
E
Protect collected evidence from unauthorized access or changes.

Fill in the blank

1 point

After containment, removing malicious tools, closing the exploited weakness, and correcting unsafe configurations are part of the effort to the threat.

Choose one

1 point

A developing incident may affect sensitive information and requires urgent decisions. What should responders use to ensure the matter reaches the appropriate teams?

A
Wait until the investigation is complete before involving any other team.
B
Use the severity scheme and escalation path to reach the appropriate teams for an urgent threat.
C
Send every alert to every employee so no one is left uninformed.
D
Escalate only to technical staff, regardless of the incident's impact.

Choose all

1 point

Which actions support a trustworthy recovery after an incident? Select all that apply.

A
Restore from known-good backups or rebuild affected systems when warranted.
B
Reconnect systems before addressing the entry path so service returns sooner.
C
Address the entry path and persistence before reconnecting systems.
D
Reset affected credentials and keys, apply needed updates, and test systems and controls.
E
Restore all services at once without monitoring for renewed compromise.

Choose one

1 point

A team wants to restore a compromised system quickly to bring a service back online, but has not verified that the restored system is trustworthy. Which CIA principle is most directly at risk in this decision?

A
Confidentiality, because fast restoration always exposes information.
B
Integrity, because returning a compromised system to service without verification can repeat the incident.
C
Availability, because restoring service always reduces it.
D
None of the CIA principles, because only operational needs matter.

Open ended

1 point

A suspected compromise affects a safety-critical system, and isolating it could disrupt safe operations. Describe how responders should choose and carry out containment, including who they should coordinate with and how they should handle documentation and evidence.

Choose one

1 point

After an incident has been handled, which action best applies what the organization learned?

A
Close the incident record without changing anything unless a service remains unavailable.
B
Identify practical improvements, update detections or procedures, and exercise the revised procedures.
C
Share all collected evidence broadly so every team can decide what to change.
D
Focus only on restoring the affected service as quickly as possible.

Choose one

1 point

A responder is designing access controls to reduce the chance that an attacker can move from one compromised account to another. Which approach best applies least privilege and zero trust?

A
Trust an account once it has connected from inside the organization's network.
B
Give every responder broad access so investigations can proceed without access delays.
C
Verify identity and device context, grant only needed access, and reassess access as conditions change.
D
Restrict access only after an account has been confirmed to cause harm.

Choose one

1 point

An account has repeated failed logins, then a successful login from an unusual location, followed by access to sensitive files. What is the most appropriate assessment?

A
Treat the first failed login as proof that the account was compromised.
B
Correlate the repeated failures, unusual successful login, and sensitive-file access as a pattern that warrants investigation.
C
Ignore the successful login unless a service becomes unavailable.
D
Classify the activity as harmless because failed logins are common.

Written response

1 point

What response-stage term describes removing malicious tools, closing an exploited weakness, and correcting unsafe configurations after a threat has been contained?

True or false

1 point

True or false: If a collected file's hash matches a later hash, that fact alone proves the evidence is authentic.

A
True
B
False

Choose one

1 point

Responders suspect compromise of a safety-critical operational technology system. Because isolating it could create hazards, what should they do?

A
Immediately disconnect the system because containment always takes priority over operational safety.
B
Leave the system connected until the investigation is complete.
C
Assess the threat and safety implications, then coordinate an appropriate containment measure with system owners.
D
Disable all safety controls before isolating the system.

Written response

1 point

What is the term for the record of who handled evidence, when, and why?