1.8 Identify the Challenges of Data Visibility (network, Host, and Cloud) in Detection 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices that the IDS is not generating alerts for a known malware family that communicates over HTTPS. The network team confirms that the firewall is logging connections, but the IDS sees only the TLS handshake. Which action would most directly improve visibility into this traffic?

   • AIncrease the IDS sensor's memory allocation to handle larger TLS handshake buffers
   • BMove the IDS sensor to a different network segment to capture more TLS handshakes
   • CConfigure the firewall to log the full TLS session keys
   • DEnable SSL/TLS decryption on the IDS and install the corresponding CA certificate on monitored endpoints
   Reveal Solution Discussion Select an answer first
2. 12expert · hard · select all that apply

   A security team is investigating a potential malware outbreak. The team has EDR agents on most endpoints, but some endpoints are not covered. The team also has network flow logs and cloud API logs. Which of the following are likely consequences of the incomplete host visibility? (Select all that apply.)

   • AThe team may have delayed incident response due to missing host logs.
   • BThe team may miss the initial infection on an uncovered endpoint.
   • CThe team can use cloud API logs to replace host logs.
   • DThe team can rely on network flow logs to see all host activity.
   • EThe team may not be able to determine the full scope of the outbreak.
   Check answers Discussion Select an answer first
4. 13expert · hard · select all that apply

   A security team is trying to improve detection capabilities across network, host, and cloud. The team has limited budget and must prioritize. Which of the following are effective ways to address visibility gaps? (Select all that apply.)

   • ADeploy network sensors at key points, such as internet egress and internal segmentation boundaries.
   • BDisable encryption on all traffic to ensure visibility.
   • CEnable detailed logging on all hosts, including command-line arguments and file access.
   • DRely solely on cloud provider's default logging.
   • EUse cloud API logs to monitor all cloud resource activity.
   Check answers Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a potential compromise in a cloud environment. The attacker created a VM, used it for a few minutes, and then deleted it. The analyst checks the cloud provider's activity logs and finds API calls that created and deleted the VM, but no OS-level logs from the VM itself. What is the primary reason for this visibility gap?

   • AThe VM was created in a different region than the analyst's monitoring tools
   • BThe VM's network traffic was encrypted, preventing log collection
   • CThe VM's OS logs were not collected because the VM was ephemeral and no agent was installed
   • DThe cloud provider does not log API calls for VM creation and deletion
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team discovers that an attacker has been exfiltrating data from a server for three weeks. The team has network flow logs and host authentication logs, but no packet captures or process-level logs. What is the most likely impact of these visibility gaps on the investigation?

   • AThe team can easily identify the attacker's identity from the flow logs
   • BThe team can determine the exfiltration method from the network flow logs
   • CThe team can reconstruct the exfiltration timeline from authentication logs alone
   • DThe team cannot determine the exact data that was exfiltrated or the process used to exfiltrate it
   Reveal Solution Discussion Select an answer first