Describe the Significance of Continuous Monitoring and Associated Security Controls in the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of continuous monitoring, what does 'monitoring scope and coverage' refer to?

   • AThe range of assets and activities monitored, including networks, systems, applications, and user behavior
   • BThe physical location of the security operations center
   • CThe frequency of security awareness training for employees
   • DThe number of security personnel assigned to monitor alerts
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does continuous monitoring in the DETECT function integrate with the RESPOND function of the NIST Cybersecurity Framework?

   • ABy eliminating the need for an incident response plan
   • BBy providing timely alerts and information that enable the response team to act quickly
   • CBy restoring systems to normal operation after an incident
   • DBy automatically containing and eradicating threats without human involvement
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company's security operations center (SOC) detects a potential ransomware infection on a production server. The SOC needs to contain the threat quickly and then restore operations. Which integration of DETECT with other functions is most critical for this scenario?

   • AThe firewall blocks all outbound traffic from the server, but no alert is sent to the SOC.
   • BThe vulnerability scanner identifies the ransomware's entry point and patches the vulnerability.
   • CThe SIEM automatically creates an incident ticket and notifies the incident response team, who then isolate the affected server.
   • DThe backup system automatically restores the server without human intervention.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services firm must detect unauthorized access to customer data in its cloud-based customer relationship management (CRM) system. The firm has a SIEM but is not currently monitoring cloud application logs. What should the firm do to improve its continuous monitoring coverage?

   • ADeploy a network IDS in the firm's on-premises data center.
   • BEnable audit logging in the CRM and configure the SIEM to ingest and analyze those logs.
   • CRely on the cloud provider's built-in security alerts without integrating them into the SIEM.
   • DConduct monthly penetration tests on the CRM system.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software development company wants to monitor its code repository and build system for signs of malicious activity, such as unauthorized code changes or compromised credentials. Which monitoring approach should the company adopt?

   • AConduct quarterly code reviews to identify unauthorized changes.
   • BMonitor only the network traffic between developers' workstations and the code repository.
   • CDeploy a web application firewall in front of the code repository.
   • DEnable audit logging on the code repository and build system, and feed the logs into a SIEM for anomaly detection.
   Reveal Solution Discussion Select an answer first