Enhance Detection and Response CY0-001 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations team is integrating an AI-based threat intelligence platform with their existing SIEM. The platform provides a feed of malicious IP addresses and domains. The team wants to automatically block these IOCs at the firewall. However, they are concerned about blocking legitimate services that may be shared with malicious actors (e.g., cloud providers). What is the best way to mitigate this risk?

   • ABlock all IOCs immediately to ensure maximum security.
   • BBlock the IOCs only during off-peak hours to minimize business impact.
   • CConfigure the firewall to block the IOCs, but with a higher confidence threshold and a review process for any blocks that affect critical services.
   • DDo not block any IOCs and only use the feed for manual analysis.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center (SOC) is using a SIEM that generates thousands of alerts per day. The analysts are struggling to prioritize which alerts to investigate first. They want to use AI to improve the efficiency of their security analytics. Which approach would best address this challenge?

   • AStore all alerts in a separate database for future analysis.
   • BImplement an AI model that scores and prioritizes alerts based on risk and potential impact.
   • CDisable all alerts and rely on weekly manual log reviews.
   • DIncrease the number of SIEM rules to generate more detailed alerts.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's automated incident response system is configured to quarantine any endpoint that communicates with a known command-and-control (C2) server. During a routine security test, the system quarantines a developer's workstation because it briefly connected to a test server that was mistakenly listed as a C2 server. The developer is working on a critical release. What is the most appropriate action for the security team?

   • AIncrease the sensitivity of the detection system to prevent future false positives.
   • BLeave the workstation quarantined until the security test is complete.
   • CReview the alert, confirm it is a false positive, and restore the workstation while updating the threat intelligence feed to remove the incorrect entry.
   • DPermanently disable automated quarantine for all endpoints.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is deploying a behavioral analytics system to detect insider threats. The system will monitor user activity, including file access, email, and application usage. The company has a strict privacy policy that limits monitoring of employee communications. How should the team configure the system to balance security and privacy?

   • AMonitor only file access and ignore email and application usage.
   • BMonitor all communications, including content, to ensure no insider threat is missed.
   • CConfigure the system to monitor metadata (e.g., who, when, where) but not the content of communications, and focus on anomalies in access patterns.
   • DDo not monitor any user activity to respect employee privacy.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What type of data is most commonly analyzed by AI behavioral analysis to detect anomalies?

   • AFinancial statements to detect accounting fraud.
   • BMarketing data to understand customer preferences.
   • CUser and entity behavior logs, such as login times, access patterns, and resource usage.
   • DSource code repositories to find programming errors.
   Reveal Solution Discussion Select an answer first