Elaborate the Tools and Techniques That Can Be Employed for Achieving Continuous Monitoring and Adverse Event Analysis. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A security operations center (SOC) receives thousands of alerts daily from its SIEM, but analysts are overwhelmed and miss critical incidents. The SOC wants to improve the efficiency of its monitoring and analysis process. Which approach would best achieve this while maintaining effective detection?

   • ADisable all alerts that are not marked as critical
   • BImplement alert correlation rules that group related events into a single incident
   • CIncrease the number of alerts by adding more data sources
   • DAssign a single analyst to manually review every alert
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which technique is used to reconstruct the sequence of events leading up to a security incident by examining logs and system artifacts?

   • AVulnerability assessment
   • BRoot cause analysis
   • CThreat hunting
   • DTimeline analysis
   Reveal Solution Discussion Select an answer first