Qwissit Cybersecurity

ISC2 CC

Security Operations and Incident Response

12 of 60 questions in the app

Logging and monitoring

  1. What is a SIEM system? Easy
  2. Why must all systems use the same, accurate time? Easy
  3. What is the difference between a security event and a security incident? Easy

Triage

  1. By what are security alerts mainly prioritized during triage? Easy

Threat actors

  1. Which threat actor is usually motivated by money? Easy
  2. What typically drives hacktivists? Easy
  3. What is an insider threat? Easy
  4. What is an advanced persistent threat (APT)? Easy

Logging and monitoring

  1. Which log sources are particularly valuable for detecting attacks? Medium
  2. What does correlation mean in a SIEM? Medium

Incident response

  1. An analyst discovers ransomware running on a server, currently encrypting files. What is the correct first step? Hard
  2. After a phishing incident, the affected account is locked and the e-mail deleted from all mailboxes. Two weeks later, the attacker is back. What was probably neglected? Hard

Certifications & exams

Which exam comes next?

You can already practise for 19 exams, and 21 are up for a vote. See all certifications with their official information, cast your vote or suggest your exam.

See all certifications