Elaborate the Tools and Techniques That Can Be Employed for Achieving Continuous Monitoring and Adverse Event Analysis. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A retail company wants to detect point-of-sale (POS) malware that steals credit card data. The security team has deployed endpoint detection and response (EDR) on all POS terminals. Which additional monitoring tool would best complement the EDR to detect network-based exfiltration of card data?

   • AVulnerability scanner that runs monthly
   • BNetwork traffic analysis (NTA) tool that inspects outbound traffic for anomalies
   • CHost-based firewall that blocks all outbound connections
   • DAntivirus software with signature updates
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which analysis technique is primarily used to determine the root cause of an adverse event so that effective remediation steps can be taken?

   • ASignature matching
   • BLog correlation
   • CNetwork flow analysis
   • DRoot cause analysis
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A financial services firm must detect anomalous outbound data transfers that could indicate data exfiltration. The security team has deployed a SIEM that ingests firewall logs, but they need a tool that can inspect the actual content of network traffic in real time to identify sensitive data leaving the network. Which tool should they add to their monitoring stack?

   • AHost-based intrusion detection system (HIDS) on each endpoint
   • BData loss prevention (DLP) solution that performs deep packet inspection
   • CNetwork-based intrusion detection system (NIDS) with signature-based detection
   • DVulnerability scanner that runs periodic network assessments
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing an alert about a suspicious PowerShell command executed on a workstation. The analyst wants to determine if this was a legitimate administrative action or a sign of compromise. Which adverse event analysis technique would be most effective?

   • ARebooting the workstation to clear any malicious processes
   • BReviewing the user's email for phishing attempts
   • CChecking the workstation's firewall settings
   • DCorrelating the PowerShell event with the user's role and recent activity
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How do continuous monitoring tools and adverse event analysis techniques work together in the DETECT function?

   • AMonitoring tools generate alerts, and analysis techniques interpret those alerts to determine if a real incident occurred and what response is needed.
   • BMonitoring tools and analysis techniques are independent and do not need to be integrated for effective detection.
   • CMonitoring tools replace the need for analysis because they automatically respond to all detected anomalies.
   • DAnalysis techniques are used only after a breach is confirmed, while monitoring tools are used only during an active attack.
   Reveal Solution Discussion Select an answer first