Describe Role of Visibility and Analytics ZERO-TRUST-DESIGN Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A global manufacturing company is adopting a Zero Trust model. The security team wants to detect lateral movement by an attacker who has compromised a single user's laptop. They plan to collect authentication logs, network flow logs, and endpoint process-creation events. Which combination of visibility sources is essential to detect the attacker's movement from the laptop to other internal systems?

   • ACorrelate authentication logs with network flow logs and endpoint process-creation events to identify anomalous access patterns and command execution on multiple hosts.
   • BEnable verbose logging on all firewalls and review only the firewall deny logs for suspicious outbound traffic.
   • CCollect only authentication logs from all domain controllers and analyze them for failed logon attempts.
   • DDeploy a SIEM and ingest only endpoint process-creation events, relying on the SIEM's built-in analytics to detect anomalies.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a key step in operationalizing visibility and analytics into daily monitoring workflows?

   • AStoring all telemetry in a single log file for simplicity
   • BDisabling analytics during maintenance windows to reduce noise
   • CEstablishing a routine for reviewing alerts and dashboards
   • DLimiting visibility to only executive-level users
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company uses behavioral analytics to detect insider threats. The analytics platform flags a user who is downloading a large number of files from a file share. The user is a data analyst who regularly downloads data for their job. The SOC must decide whether to alert or ignore this activity. What is the most appropriate course of action?

   • AIgnore the activity because the user has a legitimate need to download data.
   • BAlert the user's manager and ask them to confirm the downloads are work-related.
   • CImmediately block the user's access to the file share.
   • DEscalate the alert to law enforcement.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes the role of continuous visibility in a Zero Trust architecture?

   • AIt replaces the need for identity and access management (IAM) controls
   • BIt enables security teams to observe and assess activity across users, devices, and traffic on an ongoing basis
   • CIt focuses only on external threats and ignores internal user behavior
   • DIt provides a one-time assessment of the network at deployment
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to integrate visibility and analytics into their daily security operations. They have a SIEM that collects logs from various sources. Which practice is most effective for operationalizing this visibility?

   • AOnly review SIEM alerts when a security incident is reported.
   • BStore all logs but never analyze them until a breach occurs.
   • CConfigure the SIEM to generate alerts for every log entry and have analysts review all alerts.
   • DCreate dashboards that show key security metrics and review them during daily stand-up meetings.
   Reveal Solution Discussion Select an answer first