Elaborate the Tools and Techniques That Can Be Employed for Achieving Continuous Monitoring and Adverse Event Analysis. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating an alert about a user account that was used to access a sensitive database from an unusual location. The analyst has access to the SIEM, which shows the login event, but the analyst needs to determine if the account was compromised. Which analysis would be most effective in confirming or ruling out compromise?

   • AReviewing the database's access control list
   • BChecking the user's password expiration date
   • CCorrelating the login event with the user's recent activity and device fingerprint
   • DResetting the user's password and forcing a re-login
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After a security incident, an analyst needs to determine the root cause of a malware infection on a server. The analyst has access to the SIEM, endpoint logs, and network captures. Which analysis technique would best help identify how the malware initially entered the environment?

   • AChecking the server's uptime and last reboot time
   • BReviewing the server's firewall rules
   • CRunning a vulnerability scan on the server
   • DPerforming a timeline analysis that correlates endpoint logs with network traffic
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which monitoring tool is most appropriate for detecting unauthorized changes to critical system files on a server?

   • ASecurity Information and Event Management (SIEM) system
   • BFile Integrity Monitoring (FIM) tool
   • CNetwork Intrusion Detection System (NIDS)
   • DVulnerability scanner
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company has deployed a SIEM that collects logs from its OT (operational technology) network. The security team wants to detect cyber threats that could affect production, but they are concerned about the high volume of false positives. Which approach would best integrate monitoring and analysis to reduce false positives while maintaining detection capability?

   • AIncreasing the sensitivity of all detection rules to catch more events
   • BImplementing a baseline of normal OT network behavior and alerting on deviations
   • CDisabling alerts for all OT devices that are not internet-facing
   • DUsing only signature-based detection to match known malware
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university's IT team has deployed a SIEM that collects logs from its authentication system, firewall, and endpoints. They want to detect a multi-stage attack that starts with a phishing email, then compromises a user account, and finally moves laterally to other systems. Which approach would best enable the SIEM to detect this attack chain?

   • AIncreasing the log retention period to one year
   • BCreating correlation rules that link authentication failures with subsequent lateral movement events
   • CDeploying a honeypot to attract attackers
   • DUsing a vulnerability scanner to identify weak points
   Reveal Solution Discussion Select an answer first