CISSP Domain 7 · 13% of the exam
Running security day to day: investigations and evidence, logging and monitoring, incident response, change and patch management, backups, recovery sites and disaster recovery.
| Incident response | Detect → Respond → Mitigate (contain) → Report → Recover → Remediate (root cause) → Lessons learned. Same incident repeating = remediation failed; many different incidents = weak preparation. |
|---|---|
| NIST SP 800-61 | Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-incident activity (Rev. 3 aligns with CSF 2.0). |
| Forensics | Identify → Preserve → Collect → Examine → Analyze → Present → Decide · RAM before disk · never work on the original (bit image + write blocker + hash) · chain of custody throughout. |
| Order of volatility | CPU registers/cache → RAM → swap → disk → remote logs → archival media. |
| Evidence | Relevant + material + competent · best evidence = original · parol evidence = the written contract wins · hearsay ✗ except business records (logs). |
| Backups | Restore speed: Full > Differential > Incremental (backup speed is the reverse) · incremental resets the archive bit, differential does not · 3-2-1 rule · RAID is not a backup. |
| RAID | 0 striping (no redundancy) · 1 mirroring · 5 striping + parity (1 disk) · 6 double parity (2 disks) · 10 mirror + stripe. |
| Recovery sites | Mirror = minutes · Hot = hours · Warm = days · Cold = weeks · recovery team → alternate site (critical first) · salvage team → repairs primary (least critical moves back first). |
| Metrics | RPO = data loss tolerance · RTO = time to restore · WRT = time to verify · MTD = RTO + WRT · MTBF = repairable · MTTF = non-repairable · MTTR = repair time. |
| Ops controls | Least privilege · need to know · SoD (preventive) · job rotation / mandatory vacation (detective) · two-person control for critical tasks. |
| Change management | Request → Impact assessment → Approve → Test → Notify → Implement → Validate → Document. Emergency changes are still documented afterwards. |
| Vulnerability management | Detect → Validate (false positive?) → Prioritise by risk → Remediate · no patch available → compensating control (WAF / virtual patching). |
| e-Discovery (EDRM) | Governance → Identify → Preserve (legal hold) → Collect → Process → Review → Analyze → Produce → Present. |
| Term | Simple meaning | Example / analogy | Exam hook |
|---|---|---|---|
| Containment | Stop the spread | Isolate the infected server | First action once an incident is confirmed |
| Remediation | Fix the root cause | Patch the exploited bug | After recovery |
| Order of volatility | Collect what disappears fastest first | RAM before disk | Never pull the plug first |
| Chain of custody | Record of who held evidence, when and why | Courier tracking for evidence | Gaps = inadmissible |
| Write blocker | Device that prevents changes to the original disk | — | Preserves integrity |
| Legal hold | Order to keep data for litigation | Do not delete those emails | Overrides retention |
| Spoliation | Destroying evidence | Deleting held data | Illegal |
| SIEM / SOAR | Collect + correlate logs / automate response playbooks | Alert → host auto-isolated | Automated response → SOAR |
| Threat hunting | Proactively search for hidden attackers | Assume breach | Proactive, not alert-driven |
| Sandbox | Isolated place to detonate suspicious files | Attachment tested before delivery | Unknown malware |
| Honeypot | Decoy system to attract attackers | Fake vulnerable server | Enticement, legal |
| Electronic vaulting / remote journaling | Bulk backups sent off-site / transaction logs sent continuously | — | Journaling = transaction level |
| Parallel test | DR site runs alongside production | Both run; compare results | Critical system, no disruption |
| Non-adversarial event | Disruption with no attacker | Power cut, flood, hardware failure | → DR / BCP thinking |
| UPS vs generator | Battery bridge (instant) vs fuel power (starts after outage) | Inverter vs diesel genset | Zero downtime → UPS |
Read the full Domain 7 cheat sheet →
Try each question before opening the answer. The full bank has many more Domain 7 questions with filters and progress tracking.
Question 1 · FIRST
Answer: B — Contents of system memory
Order of volatility: most volatile first, so RAM before disk, logs and backups. Never pull the plug before capturing memory.
Question 2 · NEXT
Answer: D — Test the change in a non-production environment
Change flow: request → impact assessment → approval → test → notify → implement → validate → document. Approval is done, so testing comes next; impact assessment was already completed before approval.
Question 3 · LEAST
Answer: A — Cold site
Cold sites provide space and power only, so they are cheapest but take weeks to bring online. Warm, hot and mirrored sites cost progressively more and recover faster.
Question 4 · NOT
Answer: C — It was obtained secretly without following any process
Admissible evidence must be relevant, material and competent (legally obtained with a documented chain of custody). Evidence gathered outside any process may be excluded.
Question 5 · BEST
Answer: A — Daily full backups
Fastest RESTORE = full backup (only one set to restore). Incremental = slowest restore (full + every incremental). Full is the slowest to BACK UP but the fastest to RESTORE.
Question 6 · PRIMARY
Answer: A — Full-interruption (cutover) test
A full-interruption test actually disconnects or shuts down primary production systems and forces live operations to run from the alternate DR site. While it provides the highest validation quality, it carries significant operational risk and requires executive approval.
Question 7 · MOST
Answer: B — Best evidence (original document or data)
The correct answer is "Best evidence (original document or data)" because it directly fulfills the operational requirement according to CISSP Domain 7 principles. Specifically, The Best Evidence Rule prefers originals; copies/secondary evidence may be challenged. Conversely, alternative options such as "Standard Hearsay operational enforcement procedure" are incorrect because they do not provide appropriate risk mitigation or control depth. Furthermore, "Standard Opinion operational enforcement procedure" is wrong because it deviates from standard security management best practices.
Question 8
Answer: A — Standard NIST operational enforcement procedure
The correct answer is "Standard NIST operational enforcement procedure" because it directly fulfills the operational requirement according to CISSP Domain 7 principles. Specifically, NIST publishes SCAP — a suite of specifications for automated security configuration validation. Conversely, alternative options such as "Standard ISO operational enforcement procedure" are incorrect because they do not provide appropriate risk mitigation or control depth. Furthermore, "PCI Council" is wrong because it deviates from standard security management best practices.
Question 9 · FIRST
Answer: C — Document its physical location, photograph it in place, and safely package it as evidence with a chain-of-custody log
When physical evidence such as an unauthorized USB drive is discovered, the analyst must preserve the scene by documenting the exact physical context, photographing it in place, and securing it in anti-static evidence packaging with chain-of-custody documentation. Plugging it into any machine risks malware execution or evidence alteration; taking it off-site breaks custody; formatting it destroys vital forensic evidence.
Question 10 · NEXT
Answer: C — Recover affected systems from clean, verified backups
CISSP IR flow: detect → respond → mitigate → report → recover → remediate → lessons learned. Containment (mitigate) and reporting are done, so recovery is next.
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
