Identify the Increasing Data Security Threats to IT Systems and Data. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm is reviewing its data security posture. The CISO is particularly worried about the rising threat of insider threats, specifically data exfiltration by a departing employee. Which control is most directly aimed at detecting and deterring this specific threat?

   • ADeploying a Security Information and Event Management (SIEM) system to aggregate and correlate logs from all critical systems
   • BConducting regular access reviews to ensure employees only have the permissions required for their current role
   • CImplementing a Data Loss Prevention (DLP) solution that monitors and blocks the transfer of sensitive data to unauthorized external destinations
   • DIncreasing the frequency of mandatory security awareness training for all employees
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is debating between investing in a new SIEM and hiring a dedicated threat hunter. The company's main concern is detecting sophisticated attacks that have already bypassed their preventative controls. Which option is the most effective approach to address this concern?

   • ANeither is effective, so the company should focus on improving its preventative controls
   • BInvesting in a new SIEM, because it will automatically correlate all logs and generate alerts for any suspicious activity
   • CHiring a threat hunter, because they can proactively search for indicators of compromise and anomalies that automated tools may miss
   • DBoth are equally effective, so the decision should be based on budget
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A security analyst is investigating an alert about a user account that was locked out after multiple failed login attempts. The attempts originated from several different countries in a short time span. This is most likely an indicator of what type of threat?

   • AA data exfiltration attempt
   • BA ransomware infection
   • CA brute-force or credential-stuffing attack
   • DA distributed denial-of-service (DDoS) attack
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is implementing a Zero Trust architecture. They have deployed Multi-Factor Authentication (MFA) for all users, but a recent phishing attack bypassed MFA using an adversary-in-the-middle (AiTM) proxy. Which additional control would most effectively mitigate this specific threat?

   • AIncreasing the frequency of user security awareness training
   • BRequiring users to change their passwords more frequently
   • CImplementing phishing-resistant MFA, such as FIDO2 security keys
   • DImplementing a conditional access policy that blocks sign-ins from unknown locations
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's security team has detected a sophisticated attack. The attacker has been in the network for several months, moving laterally and exfiltrating data. The team's EDR solution did not alert on the initial compromise. Which concept best explains why the attack went undetected for so long?

   • AThe attacker was an insider with legitimate credentials
   • BThe EDR solution was not installed on all endpoints
   • CThe EDR solution was not properly configured to send alerts to the SIEM
   • DThe attack used fileless techniques and legitimate administrative tools, making it difficult for signature-based detection to identify
   Reveal Solution Discussion Select an answer first