Describe Role of Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services firm uses a Zero Trust architecture. The security operations center (SOC) wants to detect an insider threat who is exfiltrating data by uploading large files to a personal cloud storage account during off-hours. The firm has user entity and behavior analytics (UEBA) in place. Which behavior pattern should the SOC configure to trigger an alert?

   • AA new employee who is still in training accesses the HR portal to view their own records.
   • BA user who frequently uploads large files to the corporate SharePoint site continues to do so during business hours.
   • CAn administrator who regularly performs backups to an external drive does so at the same time each week.
   • DA user who normally uploads less than 100 MB per month suddenly uploads 5 GB in a single night from a corporate laptop.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses behavioral analytics to detect anomalies. The analytics platform flags a user who has never accessed a particular server before, but the user is an administrator. What is the most appropriate response?

   • AImmediately block the user's access to the server.
   • BInvestigate the alert to determine if the access is legitimate or a sign of compromise.
   • CIgnore the alert because the analytics platform is known to generate false positives.
   • DTreat the alert as a false positive because the user is an administrator.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company uses behavioral analytics to detect anomalies. The analytics platform flags a user who is accessing a sensitive database at an unusual time of day. The user is a database administrator who has legitimate access. The SOC must decide how to respond. What is the most appropriate course of action?

   • AEscalate the alert to the user's manager without further investigation.
   • BIgnore the alert because the user has legitimate access to the database.
   • CImmediately revoke the user's access to the database.
   • DInvestigate the alert by reviewing the user's recent activity and the specific database queries.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which type of telemetry would provide the most direct insight into the security posture of an individual endpoint device?

   • AFirewall deny logs
   • BDHCP lease logs
   • CDNS query logs from the corporate DNS server
   • DEndpoint detection and response (EDR) logs
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of telemetry data used for monitoring in a Zero Trust architecture?

   • AThe company's marketing strategy presentation
   • BNetwork flow logs showing communication between hosts
   • CThe organization's employee handbook
   • DA list of approved software vendors
   Reveal Solution Discussion Select an answer first