Describe the Significance of Continuous Monitoring and Associated Security Controls in the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational corporation must comply with data residency regulations that require customer data to remain in specific geographic regions. The company wants to implement continuous monitoring across its cloud and on-premises environments while ensuring that monitoring data does not leave the required regions. What should the company do?

   • ADeploy regional SIEM instances in each required region and configure them to collect and analyze logs locally.
   • BDisable logging for systems that contain customer data to avoid compliance issues.
   • CUse a single global SIEM and store all logs in a central location outside the required regions.
   • DRely on the cloud provider's monitoring services without reviewing the data location.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization's SIEM generates an alert for a potential malware infection on a file server. The incident response team needs to quickly determine the scope of the infection and contain it. Which action best demonstrates the integration of DETECT with RESPOND?

   • AThe SIEM alert triggers a playbook that automatically isolates the file server from the network and notifies the incident response team.
   • BThe security team waits for the next scheduled vulnerability scan to confirm the infection.
   • CThe backup system automatically restores the file server from the last known good backup.
   • DThe SIEM alert is stored in a log for future analysis.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A government agency must monitor both its internal network and remote employee activities to detect potential data exfiltration. The agency uses a mix of on-premises servers and cloud-based collaboration tools. What should the agency implement to achieve comprehensive monitoring?

   • AMonitor only the on-premises network traffic with an IDS.
   • BConduct annual security awareness training for employees on data handling.
   • CUse endpoint detection and response (EDR) on all employee devices, but do not integrate with other logs.
   • DDeploy a SIEM that collects logs from network devices, servers, and cloud collaboration tools, and configure alerts for unusual data transfers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A university is expanding its continuous monitoring program to cover user activities on its learning management system (LMS) and student information system (SIS). The security team wants to detect compromised accounts and insider threats. Which monitoring approach best addresses this need?

   • ADeploy additional firewalls between the LMS and SIS to segment the network.
   • BEnable detailed audit logging on the LMS and SIS, and feed those logs into a SIEM for user behavior analytics.
   • CConduct quarterly manual reviews of access logs for all users.
   • DMonitor only network traffic to and from the LMS and SIS servers.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company wants to detect brute-force attacks against its customer-facing web application. The application is hosted on a cloud platform. Which control should the company implement to provide continuous monitoring and alerting for this specific threat?

   • AConfigure the web application firewall (WAF) to log and alert on repeated failed login attempts.
   • BInstall a host-based IDS on the web server and monitor system logs.
   • CEnable network flow logs on the cloud virtual network and review them weekly.
   • DUse a vulnerability scanner to identify weak passwords on the application.
   Reveal Solution Discussion Select an answer first