Describe the Significance of Continuous Monitoring and Associated Security Controls in the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is continuous monitoring considered important in the DETECT function of the NIST Cybersecurity Framework?

   • AIt helps organizations identify potential security incidents quickly, reducing the time to respond
   • BIt is only necessary for large enterprises with extensive IT infrastructure
   • CIt eliminates the need for security policies and procedures
   • DIt guarantees that no security breach will ever occur
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational company operates in regions with different privacy laws. Some regions require that personal data be processed only within that region. The company wants to implement continuous monitoring across all regions but must ensure that monitoring data, which may contain personal data, complies with these laws. What should the company do?

   • AAnonymize all monitoring data before analysis to avoid privacy issues.
   • BUse a single global monitoring solution and store all data in a central location.
   • CDeploy monitoring solutions in each region that collect and analyze data locally, and ensure that cross-region data transfers are only for approved purposes.
   • DDisable monitoring in regions with strict privacy laws.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization's continuous monitoring system detects a potential data breach, but the incident response team is not available after hours. The organization wants to ensure that a response is initiated immediately, even outside business hours. What should the organization implement?

   • AAutomated response playbooks that can contain the threat (e.g., isolate affected systems) and notify on-call staff.
   • BWait until the next business day to respond.
   • CDisable the monitoring system after hours to avoid alerts.
   • DA policy that requires the incident response team to be available 24/7.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A utility company needs to detect unauthorized changes to its industrial control system (ICS) configuration files. The changes could indicate a cyberattack. Which control should the company implement to provide continuous monitoring of these files?

   • AConduct manual audits of configuration files every six months.
   • BDeploy a file integrity monitoring (FIM) tool that continuously checks configuration files and alerts on any modifications.
   • CUse a network IDS to monitor traffic to the ICS servers.
   • DImplement a SIEM to collect logs from the ICS servers.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An organization's continuous monitoring system detects a potential advanced persistent threat (APT) that has been active for several weeks. The incident response team needs to contain the threat, but the organization also wants to preserve evidence for potential legal action. Which approach best balances these needs?

   • AErase the affected systems and restore from backups to quickly recover.
   • BContinue monitoring the APT to gather more evidence before taking any action.
   • CImmediately shut down the affected systems to stop the APT.
   • DIsolate the affected systems from the network, take forensic images, and then begin containment actions.
   Reveal Solution Discussion Select an answer first