Describe the Significance of Adverse Event Analysis and Associated Security Controls in DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company's security operations center (SOC) is overwhelmed with alerts, many of which are false positives. Which control is most effective in reducing the noise while still detecting adverse events?

   • ADisable all alerts that are not critical
   • BImplement alert correlation rules that group related alerts
   • CHire more analysts to manually review each alert
   • DIncrease the number of monitoring tools to gather more data
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the NIST Cybersecurity Framework 2.0, what is the primary purpose of adverse event analysis within the DETECT function?

   • ATo determine the root cause of an incident and assign blame to the responsible party
   • BTo identify, understand, and characterize potential cybersecurity incidents so that appropriate response actions can be taken
   • CTo automatically remediate all detected anomalies without human intervention
   • DTo ensure that all security controls are functioning correctly and producing logs
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team has completed an adverse event analysis and determined that the event was a false positive. However, the analysis revealed a gap in the monitoring coverage. What should the team do with this information?

   • AUpdate the detection rules to reduce future false positives and address the monitoring gap
   • BEscalate the false positive to incident response for further investigation
   • CDocument the false positive and close the case without further action
   • DIgnore the gap because it did not lead to a real incident
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is analyzing an adverse event and has identified the affected systems and the timeline of the attack. The analyst now needs to determine the initial entry point. Which analysis technique is most appropriate?

   • ARoot cause analysis to trace back to the origin
   • BContainment to stop the spread
   • CCorrelation to link related events
   • DTriage to classify the event
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a potential data breach. The analyst has gathered logs from the firewall, the authentication server, and the database server. What is the most effective way to analyze these logs to identify the sequence of events?

   • AFocus only on the database logs because they contain the sensitive data
   • BUse a SIEM to correlate the logs and reconstruct the timeline
   • CAsk the incident response team to handle the analysis
   • DReview each log separately in chronological order
   Reveal Solution Discussion Select an answer first