ISC2 CC · ISC2 · Security Operations and Incident Response · Bank updated 2026-11-03
ISC2 CC practice questions: Security Operations and Incident Response
5 free questions from 53 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Security Operations and Incident Response section of our ISC2 CC bank (53 questions on this area, which carries 17.3% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 53 Security Operations and Incident Response questions and the full ISC2 CC bank: $15 one-time.
1/5 · Security Operations and Incident Response
A hospital is taking 120 SSDs out of the workstations in its oncology unit. The patient data on them is categorized as high for confidentiality. The hospital wants to reuse the drives in workstations in its other departments, where they would remain under its control. Which course does the sanitization and disposition decision flow in NIST SP 800-88 Rev. 2 lead to for these drives?
APurge the drives, then reinstall them
BClear the drives, then reinstall them
CDestroy the drives, then buy replacements
DWipe the drives three times, then reinstall them
Answer: A. NIST SP 800-88 Rev. 2, Section 4.3, Fig. 1 (Sanitization and disposition decision flow), first asks whether the media will be reused. For reused media holding high-categorized data it then asks whether the media is leaving organizational control: if it is, the outcome is destroy; if it is not, the outcome is purge. Clear appears only on the low and moderate branches. Section 3.1.2 defines purge as making the recovery of target data infeasible using state-of-the-art laboratory techniques while preserving the media in a potentially reusable state, so drives that stay with the hospital can return to service after a purge.
Source: ISC2 CC Exam Outline
2/5 · Security Operations and Incident Response
A bank's cryptography team must replace the RSA-based key exchange that protects session keys between its internal payment APIs with a post-quantum mechanism. The job of the new mechanism is to let two parties agree on a shared secret over an open channel. Which standard should the team implement for that job?
AML-KEM (FIPS 203)
BML-DSA (FIPS 204)
CSLH-DSA (FIPS 205)
DAES-256 (FIPS 197)
Answer: A. FIPS 203 specifies ML-KEM, a key-encapsulation mechanism that lets two parties establish a shared secret key over a public channel, which matches the job of the RSA exchange being replaced. FIPS 204 and FIPS 205 specify digital signatures, and FIPS 197 specifies the AES block cipher, so none of them is the key-establishment standard. Source: NIST FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (Aug. 2024), https://csrc.nist.gov/pubs/fips/203/final
Source: ISC2 CC Exam Outline
3/5 · Security Operations and Incident Response
An attacker obtained credit card data belonging to an outside organization's customers, and the investigation is still running. A manager suggests saying nothing until the media call. How should the company communicate with the affected parties?
Await for media inquiries and then confirm the facts to callers
Bsend notices to the parties once the investigation has finished
Cnotify the parties and share internal findings when they ask
Dnotify the parties before others do and limit the details given
Answer: D. An attacker gaining access to sensitive information about external parties, such as credit card information, affects them directly, and in some jurisdictions notification of all affected parties is required. Regardless of the circumstances, it is preferable to notify affected external parties before the media or other organizations do. Handlers should be careful to give out only appropriate information, because details about internal investigations should not be revealed publicly.
Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012), 2.3.4.4 (SP80061r2-p22, SP80061r2-p23), pp. 22-23
Source: ISC2 CC Exam Outline
4/5 · Security Operations and Incident Response
Investigators reconstructing an intrusion find the same attack logged at 12:07:01 on the firewall, 12:10:35 on the application server and 11:07:06 on the IDPS. Correlating the events is slow and the timestamps weaken the evidence. Which preparation would have prevented this?
Aa longer log retention period configured on the three devices
Bcontinuous packet capture enabled across each network segment
Csynchronized clocks on the reporting hosts via a time protocol
Da knowledge base entry explaining the log format of each device
Answer: C. Protocols such as NTP synchronize clocks among hosts. Event correlation is more complicated if reporting devices have inconsistent clock settings, and from an evidentiary standpoint it is preferable that logs show consistent timestamps.
Source: NIST SP 800-61 Rev. 2, SP80061r2-p40, p. 40
Source: ISC2 CC Exam Outline
5/5 · Security Operations and Incident Response · easy
A staff survey shows that employees who notice suspicious activity often do not report it because they fear being identified. The company already offers a phone line, an email address and an online form for reporting. What should it add or change?
Arequire each report to carry the sender's name and employee ID
Blimit reporting to one channel monitored around the clock
Cpublish the names of the staff members who receive reports
Doffer at least one reporting channel that allows anonymity
Answer: D. Preparation includes incident reporting mechanisms such as phone numbers, email addresses, online forms and secure instant messaging that users can use to report suspected incidents, and at least one mechanism should permit people to report incidents anonymously.
Source: NIST SP 800-61 Rev. 2, SP80061r2-p32, p. 32
Source: ISC2 CC Exam Outline
Other ISC2 CC areas
The same kind of free sample for every other section of the ISC2 CC bank:
Practise ISC2 CC with instant feedback
6 free questions in study mode · no card · full ISC2 CC bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start ISC2 CC free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.