CISSP Domain 7 practice questions
Security Operations
Security Operations is where policy meets day-to-day reality: incident response, logging and monitoring, change and configuration management, disaster recovery and investigations. Process order matters. Know the incident response phases and recovery site options, and remember that people's safety outranks everything else.
Sample Domain 7 questions
A SOC analyst confirms ransomware is spreading across a file server segment. What should be done FIRST?
An investigator needs to analyse a suspect's hard drive while keeping the evidence admissible. What should they do?
A business needs systems restored within 48 hours at moderate cost. Which recovery site BEST fits?
Common Domain 7 traps
- Jumping to eradication before containment and evidence preservation.
- Choosing a hot site when the RTO and budget point to a warm site.
- Breaking chain of custody by analysing original evidence instead of a verified copy.
Key concepts to master
- Incident response life cycle
- Evidence handling and chain of custody
- Change, configuration and patch management
- DR sites: hot, warm, cold, mobile; backup strategies
- SIEM, SOAR, continuous monitoring
Need the theory first? Read the CISSP Domain 7 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.