Which of the following is an example of an automated action a SOAR platform might take in response to a detected incident?

Writing a new security policy from scratch

Creating a ticket in an IT service management system

Performing a manual forensic analysis of a hard drive

Conducting employee security awareness training

A security analyst is tuning an IDS and notices that a rule designed to detect SQL injection attacks is generating alerts for legitimate database queries that contain the word 'select'. The analyst wants to reduce false positives while still detecting actual SQL injection attempts. What should the analyst do?

Whitelist all database queries from the application server.

Disable the rule to stop the false positives.

Increase the rule's sensitivity to catch more potential attacks.

Refine the rule to look for SQL injection patterns, such as 'union select' or 'or 1=1', rather than just the word 'select'.

What is a key capability of Suricata that distinguishes it from Snort?

Multi-threaded processing for better performance

What is the primary role of a Cloud Access Security Broker (CASB) in an organization?

To provide a secure VPN connection to the cloud

To monitor and enforce security policies between users and cloud services

To replace the cloud provider's security controls

To manage on-premises network firewalls

Which pattern in network traffic is indicative of beaconing?

A single large file transfer to a remote server

Random connections to various websites

Continuous high-volume traffic to a legitimate cloud service

Regular, periodic connections to an external IP address at consistent intervals

CertNexusCyberSec First Responder (CFR)

Domain 2Objective 2

Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 11)

Part of the 2.0 Analyze Attacks on Computing Environments domain, which accounts for 20% of the CYBERSEC-FIRST-RESPONDER exam.

60questions here

12free pages

22concepts

20%of the exam

22 Concepts in This Objective

Active Monitoring Solutions Overview
IDS/IPS Functionality
SIEM Operation
EDR and XDR Capabilities
Threat Intelligence Platforms (TIP)
SOAR Automation
CASB for Cloud Monitoring
File Integrity Monitoring (FIM) Basics
FIM: Detecting File Changes
FIM Alerts and Reports
FIM Scan Schedules
Network Traffic Monitoring Fundamentals
Detection Rules for Network Monitoring
Rule Scripting for Custom Detection
Spoofing Detection Techniques
Beaconing Detection
Whitelisting in Network Monitoring
Traffic Content Inspection
Detection Logs Analysis
Snort IDS/IPS
Suricata IDS/IPS
Zeek Network Security Monitor

Questions 51–55

51foundation · easy
Which of the following is an example of an automated action a SOAR platform might take in response to a detected incident?
Select an answer first
52expert · hard
A security analyst is tuning an IDS and notices that a rule designed to detect SQL injection attacks is generating alerts for legitimate database queries that contain the word 'select'. The analyst wants to reduce false positives while still detecting actual SQL injection attempts. What should the analyst do?
Select an answer first
53foundation · easy
What is a key capability of Suricata that distinguishes it from Snort?
Select an answer first
54foundation · easy
What is the primary role of a Cloud Access Security Broker (CASB) in an organization?
Select an answer first
55foundation · easy
Which pattern in network traffic is indicative of beaconing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.