Elaborate the Tools and Techniques That Can Be Employed for Achieving Continuous Monitoring and Adverse Event Analysis. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a series of failed login attempts followed by a successful login from an unusual IP address. The analyst must determine whether the successful login was a result of a brute-force attack or a legitimate user accessing from a new location. The organization has multi-factor authentication (MFA) enabled. Which analysis would be most decisive in determining the cause?

   • AAnalyzing the failed login attempts for a pattern of common passwords
   • BChecking whether the successful login completed the MFA challenge
   • CChecking the user's account for recent password changes
   • DReviewing the user's recent travel plans
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a SOC, which combination best illustrates the integration of continuous monitoring and adverse event analysis?

   • AAn antivirus tool blocks malware, and a firewall blocks unauthorized ports.
   • BA SIEM collects logs from firewalls and endpoints, and analysts use timeline analysis to investigate a correlated alert.
   • CA vulnerability scanner runs weekly, and a patch management tool applies updates automatically.
   • DA backup system stores logs, and a compliance tool generates reports for auditors.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security operations center (SOC) has deployed a SIEM, UEBA, and a SOAR platform. The SOC is still experiencing a high number of false positives, and analysts are spending too much time investigating low-risk alerts. The SOC wants to improve the efficiency of its detection and response process. Which approach would best achieve this?

   • ACreating playbooks in the SOAR platform that automatically investigate and close low-risk alerts
   • BRequiring analysts to manually verify every alert before closing it
   • CIncreasing the number of alerts sent to analysts for manual review
   • DDisabling the UEBA module to reduce the number of alerts
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is investigating an alert about a user account that was locked out multiple times in one hour. The analyst wants to determine whether this was a brute-force attack or a user error. Which adverse event analysis technique would best help the analyst make this determination?

   • AChecking the user's password complexity settings
   • BReviewing the user's recent email for phishing attempts
   • CCorrelating authentication logs with the user's physical location and time of day
   • DRestoring the user's account and resetting the password
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has deployed a SIEM that collects logs from its on-premises and cloud environments. The security team wants to detect attacks that use legitimate administrative tools, such as PowerShell, for malicious purposes. They have enabled logging for PowerShell, but they are concerned about the volume of logs generated. Which approach would best balance detection capability with log management?

   • AConfiguring the SIEM to correlate PowerShell logs with other security events to identify suspicious patterns
   • BUsing a host-based firewall to block PowerShell execution
   • CDisabling PowerShell logging to reduce log volume
   • DStoring all PowerShell logs without any analysis
   Reveal Solution Discussion Select an answer first