1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team deploys endpoint detection and response (EDR) agents on all company laptops and desktops. After a suspected breach, the team cannot find logs from a Linux server that was used as a jump host. The server is not running the EDR agent. What is the primary visibility gap in this scenario?

   • AThe EDR agent is not compatible with Linux, so no logs can be collected.
   • BHost visibility is incomplete because not all endpoints are covered.
   • CCloud visibility is missing because the server is in a public cloud.
   • DNetwork visibility is missing because the server is not on the corporate network.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is investigating a host that is suspected of being compromised. The host's EDR agent is reporting high CPU usage and is not responding to queries. The analyst suspects the attacker is using anti-forensics techniques. Which action would best help the analyst obtain visibility despite the unresponsive EDR agent?

   • ACollect a memory dump and analyze it offline using a separate forensic workstation
   • BUninstall the EDR agent and reinstall it to restore functionality
   • CIncrease the EDR agent's priority in Task Manager to reduce CPU contention
   • DReboot the host to clear the high CPU usage and then query the EDR agent
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a hybrid environment with on-premises servers and cloud VMs. The security team uses a network IDS that only monitors the on-premises network. An attacker compromises a cloud VM and uses it to access on-premises resources through a VPN tunnel. Why might the IDS fail to detect the attacker's activities?

   • AThe VPN tunnel uses a protocol that the IDS cannot decode
   • BThe cloud VM does not generate network traffic that the IDS can see
   • CThe IDS is not configured to monitor cloud traffic
   • DThe IDS does not monitor traffic inside the VPN tunnel because it is encrypted
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is monitoring a cloud environment where developers frequently create and destroy virtual machines using infrastructure-as-code. The team notices that some VMs are only active for a few minutes and are not sending logs to the SIEM. What is the most effective way to improve visibility into these short-lived resources?

   • ARequire that all VMs be created from a golden image that includes a pre-configured logging agent
   • BDisable the ability for developers to create VMs directly
   • CIncrease the cloud provider's API logging retention period
   • DUse a network tap in the cloud to capture all traffic from VMs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing network traffic logs and notices that a workstation is communicating with a known command-and-control server using DNS. The analyst checks the host's EDR logs but finds no evidence of malware. What is the most likely reason for this discrepancy?

   • AThe malware is using DNS tunneling, and the EDR agent does not monitor DNS queries at the host level
   • BThe workstation is not the source of the DNS traffic; another host is
   • CThe DNS traffic is encrypted, so the EDR agent cannot see it
   • DThe EDR agent is configured to ignore traffic to known C2 domains
   Reveal Solution Discussion Select an answer first