CISSP - Security Operations (13% of the exam) - Section 7.7

Operate and maintain detective and preventative measures such as firewalls, IDS/IPS, allow/deny lists, sandboxing, honeypots/honeynets, and anti-malware.

Operate and maintain detective and preventative controls including firewalls, IDS/IPS, allow/deny lists, sandboxing, honeypots, honeynets, anti-malware, and EDR solutions to reduce the attack surface. Choose between preventative and detective controls based on whether the priority is blocking known threats or identifying novel behaviour.

firewallssandboxinghoneypotsanti-malwareEDR

Practice question for this objective

Free sampleSecurity Operationsmedium

A security manager is updating the endpoint protection standard and must explain to the executive committee how endpoint detection and response (EDR) differs from traditional signature-based anti-malware. Which statement BEST captures that difference?

AEDR replaces the need for any baseline anti-malware engine because behavioural analytics alone catches all known and unknown threats.
BEDR continuously records endpoint telemetry and applies behavioural analytics so analysts can detect, investigate, and respond to threats that evade signature matching. Correct
CEDR is primarily a compliance reporting tool that aggregates anti-malware alerts from endpoints into a central console for auditors.
DEDR scans files on access using a regularly updated signature database and quarantines any binary whose hash matches a known malicious sample.

Explain that EDR adds continuous endpoint telemetry, behavioural detection, and response workflows on top of signature-based anti-malware. Signature-based anti-malware compares files or hashes against a known-bad list and is effective only for previously catalogued threats. EDR continuously records process, file, network, and registry telemetry from endpoints, applies behavioural and heuristic analytics to surface suspicious activity, and gives analysts the artefacts and remote actions needed to investigate and contain incidents. Those investigation and response capabilities, layered on top of detection, are what define EDR in the CISSP CBK.

Why A is wrong: This overstates EDR capability and uses an absolute claim; in practice EDR is layered with anti-malware and other controls, and assuming complete coverage is the kind of overconfidence the CBK warns against.

Why B is correct: This captures the three pillars the CBK attributes to EDR: continuous telemetry collection, behavioural detection beyond signatures, and supported response and investigation workflows, which is why it is the BEST executive description.

Why C is wrong: Centralised reporting is a feature of many endpoint suites but it is not what defines EDR; a candidate focused on management reporting rather than detection mechanics may be drawn to this.

Why D is wrong: That description fits traditional signature-based anti-malware, which is the very control EDR is being contrasted with, so it cannot be the differentiator.

See more CISSP practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Increase the perimeter fence height to eight feet and add three-strand barbed wire outriggers angled outward to deter climb-over intrusions by determined attackers.
Why it is wrong: Taller fencing and outriggers do raise the bar against a climbing intruder, which is why it is tempting, but climbing attackers are a lower-likelihood and lower-impact threat than a vehicle ramming the building. Hardening against the dominant threat takes priority over hardening against a secondary one.
Shut the laptop down cleanly so that disk caches flush, then transport it to the lab and image the drive offline using a hardware write-blocker.
Why it is wrong: A clean shutdown re-seals the TPM and clears RAM, leaving the examiner with a ciphertext-only image and no key material; the offline image will be unreadable and the on-site opportunity will have been squandered.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.