2.4 Evaluate the Security Controls of an Environment, Diagnose Gaps, and Recommend Improvement 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A company's security policy requires multi-factor authentication (MFA) for all remote access. A review finds that the VPN is configured to accept only username and password. Which control gap is present?

   • AThe VPN does not support split tunneling.
   • BThe VPN is not encrypting traffic.
   • CThe VPN does not log user activity.
   • DThe VPN lacks an additional authentication factor.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization's endpoint protection platform (EPP) is configured to quarantine files detected as malware. During a review, the security team notices that the EPP is not receiving signature updates because the update server is unreachable from the endpoint network. What is the most likely impact on the security control's effectiveness?

   • AThe EPP will rely on behavioral analysis and may miss new signature-based threats.
   • BThe EPP will quarantine all files that cannot be verified against the latest signatures.
   • CThe EPP will automatically disable all protection features until updates resume.
   • DThe EPP will switch to a cloud-based sandboxing service to compensate.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization has a security policy that requires all administrative access to be protected by multi-factor authentication (MFA). The current environment uses MFA for VPN access but not for direct console access to servers. The security team has limited budget and must decide whether to implement MFA for console access or to implement a privileged access management (PAM) solution that includes MFA. What is the most appropriate recommendation?

   • AImplement MFA only for console access.
   • BDefer the decision until the next budget cycle.
   • CImplement a PAM solution that provides MFA for all administrative access.
   • DImplement MFA for VPN access only.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A gap analysis reveals that the organization lacks multi-factor authentication (MFA) for remote VPN access, and also lacks a formal incident response plan. The VPN is used by all employees, and the incident response plan is only needed during a breach. Which improvement should be prioritized first?

   • ADevelop the incident response plan
   • BDefer both until the next budget cycle
   • CImplement both at the same time
   • DImplement MFA for VPN access
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has implemented a security information and event management (SIEM) system, but the security team is overwhelmed by the volume of alerts, many of which are false positives. The team is considering tuning the SIEM to reduce noise, but they are concerned about missing real threats. The security policy requires that all security events be monitored. What is the most appropriate recommendation?

   • ADisable the SIEM alerts to reduce noise.
   • BTune the SIEM to reduce false positives while maintaining coverage of critical events.
   • CIgnore the false positives and focus on high-severity alerts.
   • DIncrease the alert volume to ensure no events are missed.
   Reveal Solution Discussion Select an answer first