2.4 Evaluate the Security Controls of an Environment, Diagnose Gaps, and Recommend Improvement 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is performing a gap analysis and finds that the organization's incident response plan does not include a communication plan for notifying stakeholders. The team must recommend an improvement. What is the most appropriate recommendation?

   • APurchase an incident response retainer from a third-party provider.
   • BIncrease the frequency of security awareness training.
   • CConduct a tabletop exercise to test the incident response plan.
   • DAdd a communication plan that defines roles, responsibilities, and notification procedures.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A company uses a host-based intrusion prevention system (HIPS) on all servers. During an evaluation, the team discovers that the HIPS is configured in monitor-only mode. What is the most significant impact on the security control's effectiveness?

   • AThe HIPS will block all traffic that matches a rule.
   • BThe HIPS will automatically update its rules.
   • CThe HIPS will detect but not block malicious activity.
   • DThe HIPS will not generate any alerts.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A security assessment compares the organization's patch management process to the CIS benchmark. The assessment finds that critical patches are applied within 30 days, but the benchmark recommends 14 days. What is the most accurate description of this finding?

   • AThe process is more stringent than the benchmark.
   • BThe benchmark is not applicable to this organization.
   • CThe process is fully compliant with the benchmark.
   • DA gap exists between the current process and the recommended baseline.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is conducting a gap analysis and finds that the organization's data loss prevention (DLP) solution is only monitoring email, but the policy requires DLP coverage for email, web, and endpoint storage. The team has a limited budget and must prioritize the highest-risk gap. Which recommendation should be prioritized?

   • AKeep DLP on email only and add manual data classification training.
   • BDeploy a separate endpoint protection platform (EPP) to cover endpoints.
   • CExtend DLP to endpoint storage first, as it covers data at rest on user devices.
   • DExtend DLP to web traffic first, as it covers data in motion.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security assessment reveals that the organization's web application firewall (WAF) is not logging blocked requests, and the security team cannot determine if the WAF is effectively stopping attacks. What is the most appropriate recommendation?

   • AEnable logging on the WAF and review the logs regularly.
   • BAssume the WAF is working because it is configured.
   • CDisable the WAF because it is not providing value.
   • DReplace the WAF with a network firewall.
   Reveal Solution Discussion Select an answer first