Describe the Significance of Continuous Monitoring and Associated Security Controls in the DETECT Function. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A hospital's continuous monitoring system detects a potential ransomware infection on a critical patient database. The hospital must maintain patient safety and minimize downtime. The incident response team is considering whether to isolate the database or keep it running to allow clinicians access. What is the best course of action?

   • AIsolate the database immediately to prevent the ransomware from spreading, and implement manual workarounds for clinicians.
   • BShut down the entire network to stop the ransomware.
   • CRestore the database from backups without isolating it first.
   • DKeep the database running to ensure clinicians have access, and monitor the ransomware spread.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of monitoring user activities as part of continuous monitoring?

   • AConducting annual penetration tests
   • BConfiguring firewall rules to block unauthorized ports
   • CInstalling antivirus software on endpoints
   • DTracking login attempts and access patterns to detect unusual behavior
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which security control is specifically designed to detect unauthorized access or malicious activity by monitoring network traffic?

   • APatch management system
   • BData loss prevention (DLP)
   • CIntrusion detection system (IDS)
   • DIdentity and access management (IAM)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common security control that supports continuous monitoring by collecting and analyzing log data from multiple sources?

   • AAntivirus software
   • BSecurity information and event management (SIEM)
   • CFirewall
   • DVirtual private network (VPN)
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A financial institution is required to monitor user activities on its trading platform to detect insider trading. The platform generates a large volume of logs, and the security team is concerned about the cost of storing and analyzing all logs. What is the most effective approach to meet the monitoring requirement while managing costs?

   • AUse a third-party service to analyze logs, but do not retain any logs internally.
   • BImplement a SIEM that ingests all logs, but use data filtering and aggregation to reduce storage costs while retaining critical events.
   • CMonitor only a sample of user activities to reduce log volume.
   • DStore all logs in raw format for a year without analysis.
   Reveal Solution Discussion Select an answer first