Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst is reviewing IDS alerts and notices a high volume of false positives from a rule that flags any traffic to a specific external IP range. The analyst verifies that this IP range is a legitimate cloud provider used by the company's business partners. The analyst wants to reduce the noise while still detecting real threats. What should the analyst do?

   • AAdd the IP range to the IDS whitelist and create a separate rule to monitor for anomalous behavior within that range.
   • BIncrease the IDS sensitivity to catch more potential threats.
   • CDisable the IDS rule entirely to stop the false positives.
   • DConfigure the IDS to block all traffic to the IP range.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is deploying a new security monitoring architecture. They need to monitor on-premises endpoints, cloud-based applications, and network traffic. They also want to automate response actions and integrate threat intelligence. Which combination of solutions would best meet these requirements?

   • ADeploy an XDR platform that integrates endpoint, network, and cloud data, and use a SOAR platform for automation and threat intelligence integration.
   • BUse a TIP to provide threat intelligence and an IDS for network monitoring, but no endpoint or cloud monitoring.
   • CDeploy a CASB for cloud monitoring and an EDR for endpoints, but no network monitoring.
   • DUse a standalone SIEM to collect logs from all sources and manually respond to incidents.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which factor is most important to consider when determining FIM scan frequency?

   • AThe criticality of the monitored files and the system's performance capacity
   • BThe number of employees in the organization
   • CThe color of the server rack
   • DThe version of the operating system only
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is a common use of detection logs?

   • AInstalling software updates
   • BCreating user accounts
   • CChanging network topology
   • DInvestigating a security incident after it has occurred
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of a Threat Intelligence Platform (TIP) in an organization's security operations?

   • ATo aggregate and manage threat intelligence from multiple sources for use in detection
   • BTo provide a user interface for firewall management
   • CTo replace the SIEM in log management
   • DTo block all malicious traffic automatically
   Reveal Solution Discussion Select an answer first