1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A SOC lacks visibility into a cloud environment because the cloud provider does not expose certain logs to the customer. An attacker exploits this gap to perform unauthorized actions. What is the most likely consequence for the SOC's detection capability?

   • AThe SOC may miss the attack entirely because the relevant data is not available
   • BThe SOC will detect the attack through network traffic analysis
   • CThe SOC will detect the attack through threat intelligence feeds
   • DThe SOC will detect the attack through host-based monitoring
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team relies on a network-based IDS placed at the internet edge. An attacker moves laterally between internal servers using SMB, and the IDS does not alert. The team later discovers the breach through a host-based alert. What is the most likely reason the IDS missed the lateral movement?

   • AThe IDS only monitors traffic at the internet edge, not internal east-west traffic
   • BThe IDS cannot decode SMB protocol because it is proprietary
   • CThe IDS was configured to ignore traffic from trusted internal IP addresses
   • DThe SMB traffic was encrypted with TLS, so the IDS could not inspect it
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is designing monitoring for a network that carries sensitive customer data. The team wants to inspect all traffic for threats, but the legal department requires that employee web traffic remain private and not be decrypted. The team also needs to detect malware that uses HTTPS for command-and-control. Which approach best balances these requirements?

   • AUse a network TAP to capture all traffic and analyze it offline without decryption
   • BRely solely on host-based EDR agents to detect HTTPS-based malware
   • CDecrypt only traffic to a defined list of high-risk domains and destinations, leaving other web traffic encrypted
   • DDecrypt all HTTPS traffic and store the decrypted content for 90 days
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing network telemetry and notices that a large portion of internal web traffic is not being inspected by the intrusion detection system. The traffic is between internal clients and a public SaaS application. The analyst confirms the firewall is logging connections and the IDS is receiving a copy of the traffic via a SPAN port. What is the most likely reason the IDS is missing this traffic?

   • AThe SPAN port is not configured to capture traffic from the internal VLAN.
   • BThe traffic is encrypted with TLS, so the IDS cannot inspect the payload.
   • CThe firewall is blocking the traffic before it reaches the IDS.
   • DThe IDS is placed outside the network perimeter and cannot see internal traffic.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses a multi-cloud environment with workloads in AWS and Azure. The security team is trying to centralize visibility by sending logs from both clouds to a SIEM. The team notices that some AWS CloudTrail events are missing, while Azure activity logs are complete. What is the most likely cause of this discrepancy?

   • AAzure activity logs are more reliable than AWS CloudTrail.
   • BThe SIEM is not compatible with AWS CloudTrail.
   • CThe AWS CloudTrail trail is not configured to log all event types.
   • DThe AWS account is not using the shared responsibility model.
   Reveal Solution Discussion Select an answer first