Describe the Significance of Adverse Event Analysis and Associated Security Controls in DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team has completed an adverse event analysis and determined that a phishing email led to a malware infection. How does this analysis feed into the incident response process?

   • AIt replaces the need for an incident response plan.
   • BIt is the final step in the cybersecurity lifecycle.
   • CIt provides the necessary information to contain the threat and eradicate the malware.
   • DIt is only useful for legal proceedings and not for technical response.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's security team wants to improve its ability to detect adverse events across its network. They currently have no centralized logging. Which control is most directly aligned with the DETECT function's goal of enabling adverse event analysis?

   • AEstablish a data backup and recovery process for critical systems.
   • BImplement a vulnerability management program to patch known vulnerabilities.
   • CDeploy a SIEM solution that aggregates logs from multiple sources and generates alerts.
   • DCreate an incident response plan that outlines roles and procedures.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company wants to ensure that its security monitoring tools can detect unusual behavior that may indicate an adverse event. Which combination of controls is most effective for this purpose?

   • APatch management and configuration management
   • BEndpoint detection and response (EDR) and network traffic analysis
   • CData loss prevention (DLP) and encryption
   • DFirewall rules and antivirus software
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company's SOC uses a SIEM to collect logs from firewalls, servers, and endpoints. The SIEM generates thousands of alerts per day, and analysts are struggling to identify true positives. Which strategy is most effective in improving the efficiency of adverse event analysis?

   • ADisable alerts from low-priority sources
   • BHire more analysts to manually review all alerts
   • CIncrease the alert threshold to reduce the number of alerts
   • DImplement a risk-based alerting system that prioritizes alerts based on asset criticality and threat intelligence
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company wants to detect unauthorized access attempts to its web application. Which security control is most directly aligned with this goal?

   • AWeb application firewall (WAF) that logs and alerts on suspicious requests
   • BIntrusion prevention system (IPS) that blocks malicious traffic
   • CData encryption at rest for the database
   • DRegular vulnerability scanning of the application
   Reveal Solution Discussion Select an answer first