2.4 Evaluate the Security Controls of an Environment, Diagnose Gaps, and Recommend Improvement 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is evaluating the organization's backup and recovery controls. They find that backups are performed daily, but the recovery time objective (RTO) is 4 hours, and the actual recovery time is 12 hours. The team must recommend improvements. Which recommendation best addresses the gap?

   • AConduct more recovery tests to verify the current capability.
   • BImplement a faster recovery solution, such as snapshots or replication, to meet the RTO.
   • CChange the RTO to 12 hours to match the current capability.
   • DIncrease the frequency of backups to every hour.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is evaluating the effectiveness of their access control system. They find that user accounts are not being disabled promptly when employees leave the company. The security policy requires that accounts be disabled within 24 hours of termination. What is the most appropriate recommendation?

   • AExtend the policy to 72 hours.
   • BIgnore the issue because it is a low risk.
   • CRely on the employee's manager to remember to notify IT.
   • DAutomate the account disablement process to meet the 24-hour requirement.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security team compares the current security posture of their organization to the CIS Controls baseline. What is this process called?

   • ARisk assessment
   • BGap analysis
   • CControl testing
   • DIncident response
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has implemented a SIEM solution, but the security team discovers that the SIEM is not receiving logs from the company's cloud-based email service. The security policy requires that email logs be included in the SIEM. What should the team do?

   • AConfigure the email service to forward logs to the SIEM.
   • BReplace the SIEM with a different solution.
   • CAssume the SIEM is sufficient without email logs.
   • DRemove the email service from the security policy.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   An organization has deployed a SIEM and is ingesting logs from firewalls, servers, and endpoints. The security team notices that the SIEM is not correlating events from the firewall and the endpoint because the firewall logs are in a different time zone than the endpoint logs. What is the most effective way to improve the SIEM's effectiveness?

   • AConfigure the firewall to send logs in the endpoint's time zone.
   • BNormalize the time stamps in the SIEM to a single time zone, such as UTC.
   • CManually adjust the time stamps during incident investigation.
   • DIncrease the SIEM's correlation rule thresholds.
   Reveal Solution Discussion Select an answer first