1.2 Compare Security Deployments 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary role of a Security Information and Event Management (SIEM) system?

   • ATo aggregate and correlate security logs from multiple sources for incident detection
   • BTo encrypt data at rest in storage systems
   • CTo provide a virtual private network for remote users
   • DTo block malicious network traffic in real time
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company must comply with a regulation that requires retaining security logs for at least one year and being able to produce them for audits. The logs are currently stored on local servers with limited disk space. Which practice should be implemented to meet the compliance requirement efficiently?

   • ACentralized log management with archival to cost-effective storage
   • BStore logs only for critical systems
   • CIncrease verbosity of logging on all systems
   • DDelete logs older than six months to save space
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security architect is designing a network for a new office. The team needs to inspect inbound and outbound traffic for malicious signatures, but also needs to ensure that legitimate encrypted traffic (TLS) is not blocked. The team has a limited budget and cannot deploy multiple appliances. Which single deployment provides both signature-based inspection and the ability to handle encrypted traffic?

   • AA network-based intrusion detection system (NIDS) placed inline
   • BA next-generation firewall (NGFW) with TLS inspection and IPS capabilities
   • CA VPN concentrator with split tunneling
   • DA web application firewall (WAF) in front of the web server
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization runs multiple virtual machines on a single hypervisor. The security team is concerned about the risk of one VM compromising another through the hypervisor. Which security control is most effective in mitigating this risk?

   • AInstall antivirus on each VM
   • BDisable VM snapshots
   • CUse a network firewall between VMs
   • DKeep the hypervisor patched and use VM isolation features
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of a Security Orchestration, Automation, and Response (SOAR) platform?

   • ATo provide antivirus protection for endpoints
   • BTo replace the need for a SIEM system
   • CTo manage user identities and access permissions
   • DTo automate and orchestrate security operations to respond to incidents efficiently
   Reveal Solution Discussion Select an answer first