Describe the Significance of Continuous Monitoring and Associated Security Controls in the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large e-commerce company has a SIEM that generates thousands of alerts daily, but the security team is overwhelmed and misses critical alerts. The company wants to improve the effectiveness of its continuous monitoring without adding more staff. Which approach should the company take?

   • AImplement alert correlation rules and prioritize alerts based on risk, and integrate with an automated response orchestration tool.
   • BIncrease the log retention period to one year to have more data for analysis.
   • CDisable all low-priority alerts to reduce noise.
   • DHire additional security analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A small business with limited IT staff wants to implement continuous monitoring but cannot afford a full SIEM solution. The business needs to detect common threats like malware and unauthorized access. Which approach is most cost-effective while still providing meaningful monitoring?

   • AUse a combination of free or low-cost tools, such as antivirus with real-time protection, host-based firewalls, and centralized log collection using open-source software.
   • BConduct manual reviews of system logs once a month.
   • CRely on the internet service provider's security monitoring services.
   • DPurchase an enterprise-grade SIEM and hire a dedicated security analyst to manage it.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A healthcare organization wants to correlate security events from its firewalls, servers, and applications to identify potential breaches and enable faster response. The team currently has no centralized logging. What should the organization implement first?

   • AA vulnerability scanner that runs weekly against all internal systems.
   • BAn intrusion prevention system (IPS) placed inline at the network perimeter.
   • CA file integrity monitoring (FIM) tool on critical servers.
   • DA security information and event management (SIEM) system that aggregates and correlates logs from multiple sources.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the relationship between the DETECT and RECOVER functions in the NIST Cybersecurity Framework?

   • ARECOVER replaces DETECT after an incident is resolved
   • BDetection helps confirm that recovery actions have been effective by monitoring for recurring anomalies
   • CRECOVER is only used when DETECT fails to identify an incident
   • DDETECT and RECOVER are independent and do not interact
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A regional bank must detect anomalous outbound data transfers from its internal network to external IP addresses in near real time. The security team has limited staffing and cannot manually review raw network traffic. Which control should the bank implement to best meet this requirement?

   • AImplement a data loss prevention (DLP) solution that only inspects email attachments for sensitive data.
   • BDeploy a network-based intrusion detection system (IDS) that analyzes traffic patterns and generates alerts for suspicious outbound connections.
   • CInstall host-based antivirus software on all endpoints to block malicious outbound connections.
   • DEnable verbose logging on all firewalls and review the logs weekly for unusual outbound activity.
   Reveal Solution Discussion Select an answer first