Elaborate the Tools and Techniques That Can Be Employed for Achieving Continuous Monitoring and Adverse Event Analysis. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which tool is specifically designed to collect and analyze network traffic in real time to identify suspicious patterns or anomalies?

   • AConfiguration management database (CMDB)
   • BVulnerability scanner
   • CNetwork Intrusion Detection System (NIDS)
   • DPatch management tool
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a data breach that occurred over several weeks. The analyst has access to the SIEM, which has logs from the firewall, authentication system, and endpoints. The analyst needs to determine the scope of the breach, including which systems were accessed and what data was exfiltrated. Which analysis technique would be most effective?

   • AReviewing only the firewall logs for the breach period
   • BRunning a vulnerability scan on all systems
   • CRestoring the affected systems from backup
   • DPerforming a comprehensive timeline analysis that correlates all available logs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is required to monitor access to electronic health records (EHR) and detect unauthorized access. They have deployed a SIEM that collects logs from their EHR application, but they need to ensure that user activity is monitored in real time. Which monitoring tool should they integrate with the SIEM to meet this requirement?

   • AUser and entity behavior analytics (UEBA) that profiles normal access patterns
   • BVulnerability scanner that runs weekly
   • CNetwork intrusion detection system (NIDS) placed at the perimeter
   • DFile integrity monitoring (FIM) tool that checks critical files
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution has a SIEM that generates a high number of alerts, but the security team is struggling to distinguish between genuine threats and benign anomalies. They have deployed UEBA and a SOAR platform, but the alert volume remains high. The team wants to improve the precision of their detection while minimizing the risk of missing real attacks. Which approach would be most effective?

   • ARefining the UEBA baselines to reduce false positives while maintaining sensitivity to true anomalies
   • BSetting the SIEM to automatically block all flagged IP addresses
   • CDisabling UEBA alerts and relying solely on signature-based detection
   • DIncreasing the number of data sources feeding the SIEM
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has deployed a SIEM that collects logs from its cloud infrastructure, but the security team is concerned that the SIEM is not detecting attacks that occur within encrypted traffic. They want to improve visibility without breaking encryption or degrading performance. Which approach would best achieve this?

   • AUsing a host-based intrusion detection system (HIDS) on each server
   • BConfiguring the SIEM to decrypt all TLS traffic at the perimeter
   • CDisabling encryption on internal network traffic
   • DDeploying a network traffic analysis (NTA) tool that uses machine learning to detect anomalies in encrypted traffic metadata
   Reveal Solution Discussion Select an answer first