Continuous Security Monitoring Strategies CSE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   How does continuous monitoring support the incident response process?

   • ABy automatically containing all incidents without human involvement
   • BBy providing real-time data that enables early detection and informs triage and escalation decisions
   • CBy eliminating the need for an incident response plan
   • DBy providing a backup of all data
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company uses Azure Monitor for their cloud workloads. They want to be notified immediately when a critical security event occurs, such as a virtual machine being stopped or a security rule being modified. They also want to ensure the on-call engineer is reached even if the primary notification channel fails. What should they configure?

   • AEnable Azure Defender for Cloud and rely on its default email notifications.
   • BCreate an action group with email and SMS notifications, and set up an activity log alert for the specific security events.
   • CUse Azure Service Health alerts to notify about service issues and configure email notifications.
   • DCreate a metric alert for CPU usage and configure a webhook to a third-party incident management tool.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A financial services company must provide evidence to auditors that access to customer data is continuously monitored and that unauthorized access attempts are detected. Which combination of monitoring data sources and reporting would best satisfy this requirement?

   • AUse only network flow logs to show traffic to the data stores.
   • BRely on the cloud provider's compliance certifications as proof of monitoring.
   • CConfigure a dashboard that shows current system health metrics but does not retain historical logs.
   • DEnable detailed audit logging on data stores and generate periodic reports from those logs showing access patterns and denied attempts.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst is setting up anomaly detection for a cloud environment. They have historical data for the past six months. Which approach would establish the most reliable baseline for detecting unusual behavior?

   • AUse the historical data to compute average and standard deviation for key metrics, and alert when values exceed a threshold based on those statistics.
   • BSet static thresholds based on industry best practices without considering the environment's history.
   • CUse only the most recent week of data to establish the baseline.
   • DManually review logs and define rules based on gut feeling.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security analyst is configuring anomaly detection for a cloud workload. The team has been receiving too many false positives from a rule that flags any login outside business hours. The analyst wants to reduce noise while still detecting genuinely suspicious activity. What should the analyst do?

   • ACreate a baseline of normal login times per user and alert only when a login deviates significantly from that user's historical pattern.
   • BDisable the rule and rely on manual review of login logs.
   • CIncrease the alert threshold to only trigger when logins occur on weekends and holidays.
   • DAlert on all logins from new IP addresses regardless of time.
   Reveal Solution Discussion Select an answer first