1.2 Compare Security Deployments 200-201 Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   An organization wants to replace its legacy antivirus with a solution that can detect previously unknown malware by analyzing behavior patterns rather than relying solely on known signatures. Which type of solution should be selected?

   • ANetwork-based intrusion prevention system (IPS)
   • BHost-based firewall with application control
   • CSignature-based antivirus with daily updates
   • DNext-generation antimalware with heuristic and behavioral detection
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A small business uses a legacy antivirus product on all employee workstations. Recently, a new ransomware variant infected several machines despite the antivirus being up to date. What is the most likely reason the antivirus failed to detect the ransomware?

   • AThe antivirus relies on signature-based detection and cannot identify unknown malware
   • BThe antivirus was not configured to scan email attachments
   • CThe antivirus only protects against viruses, not ransomware
   • DThe ransomware used a zero-day exploit that bypassed the operating system
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   How does SOAR improve incident response efficiency?

   • ABy providing a single console for all network traffic monitoring
   • BBy automating repetitive tasks and orchestrating workflows across security tools
   • CBy eliminating the need for human analysts
   • DBy manually reviewing every alert to ensure accuracy
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A security analyst needs to investigate a suspected compromise on a laptop. The solution must provide detailed visibility into process execution, file modifications, and network connections on the endpoint, and also allow remote response actions. Which type of security control should be used?

   • ANetwork-based intrusion detection system (IDS)
   • BEndpoint detection and response (EDR) agent
   • CHost-based firewall
   • DLegacy antivirus with signature updates
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A SOC manager is considering whether to invest in a SIEM or a SOAR platform. The team's primary challenge is that they receive thousands of alerts daily, many of which are false positives, and they lack a systematic way to prioritize and respond to genuine threats. The team also wants to reduce the time spent on manual investigation. Which solution should be prioritized first?

   • AIncrease log retention to aid in manual investigation
   • BHire more analysts to handle the alert volume
   • CDeploy a SOAR platform first to automate responses
   • DDeploy a SIEM first to improve alert correlation and reduce false positives
   Reveal Solution Discussion Select an answer first