Apply Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a Zero Trust environment, what is the primary purpose of applying analytics to collected telemetry?

   • ATo reduce the volume of logs stored in the SIEM
   • BTo eliminate the need for endpoint protection software
   • CTo support access decisions with real-time risk assessments
   • DTo replace the need for multi-factor authentication (MFA)
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses Microsoft Defender for Endpoint, Azure AD Identity Protection, and a third-party SIEM. They want to enrich SIEM alerts with identity risk signals. Which integration should they configure?

   • AConnect Azure AD Identity Protection to the SIEM via its API or connector.
   • BExport Defender for Endpoint logs to the SIEM and ignore identity signals.
   • CUse a separate console for identity alerts and correlate manually.
   • DConfigure Defender for Endpoint to send alerts directly to Azure AD Identity Protection.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center (SOC) uses a SIEM with built-in analytics. They want to detect lateral movement that often involves multiple steps across different hosts. Which analytics capability is most effective?

   • ACorrelation rules that chain events from multiple hosts into a single alert.
   • BSimple threshold alerts on single-host login failures.
   • CManual review of raw logs by analysts.
   • DPeriodic reports of top talkers on the network.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which monitoring tool is specifically designed to provide centralized log management and correlation for security events in a Zero Trust environment?

   • ANetwork performance monitor (NPM)
   • BSecurity information and event management (SIEM) system
   • CConfiguration management database (CMDB)
   • DPatch management solution
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Zero Trust environment uses a security analytics platform that applies machine learning to user behavior. The platform generates an alert for a user who is accessing an unusual number of files. What is the most appropriate response?

   • AAutomatically revoke the user's access to all resources.
   • BInvestigate the alert to determine if the behavior is legitimate or malicious.
   • CIncrease the user's permissions to reduce friction.
   • DIgnore the alert because machine learning models often produce false positives.
   Reveal Solution Discussion Select an answer first