Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company uses a cloud-based email service, an on-premises file server, and employee laptops. The security team suspects a phishing campaign may have compromised several laptops, and they need visibility into suspicious activity across all three environments from a single console. They also want to automate the containment of affected endpoints. Which solution best meets these requirements?

   • AInstall a network-based IDS at the internet gateway to monitor all traffic and block malicious communications.
   • BImplement a CASB to monitor cloud email traffic and rely on the existing EDR for laptop monitoring.
   • CUse a standalone SIEM to collect logs from all sources and manually create tickets for each suspicious endpoint.
   • DDeploy an XDR platform that integrates endpoint, network, and cloud email data, and configure automated response playbooks for endpoint isolation.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is beaconing in the context of network security?

   • AA user accessing a website frequently
   • BPeriodic communication from a compromised host to a command-and-control server
   • CA firewall sending alerts to the SIEM
   • DA network device broadcasting its presence to other devices
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which capability is characteristic of an EDR solution but NOT typically a primary feature of traditional antivirus?

   • AQuarantine of infected files
   • BScheduled full-system scans
   • CReal-time threat detection and automated response on endpoints
   • DSignature-based malware scanning
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary difference between EDR and XDR in terms of the scope of monitoring?

   • AEDR is a cloud-based solution, while XDR is on-premises only.
   • BBoth EDR and XDR monitor the same scope, but XDR is faster.
   • CXDR monitors endpoints only, while EDR extends to networks and cloud.
   • DEDR monitors endpoints only, while XDR extends monitoring to networks, cloud, and email.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which scripting language is commonly used to write custom detection rules for tools like Snort?

   • ACSS
   • BSQL
   • CHTML
   • DPython
   Reveal Solution Discussion Select an answer first