Continuous Security Monitoring Strategies CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   During which phase of incident response does continuous monitoring data play a critical role in determining the scope of an incident?

   • APreparation
   • BTriage
   • CLessons learned
   • DRecovery
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technique is commonly used to detect anomalies in cloud activity?

   • AUsing only signature-based detection
   • BComparing current behavior against a learned baseline using statistical or machine learning models
   • CManually reviewing every log entry
   • DDisabling all logging to reduce noise
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC is designing an alerting strategy for their cloud environment. They have limited staffing and are concerned about alert fatigue. They want to ensure that critical alerts are always escalated, but they also need to avoid overwhelming the team. What is the best approach?

   • AUse a single severity level for all alerts to simplify the process.
   • BSend all alerts to a single email distribution list to ensure visibility.
   • CImplement a tiered alerting system with different severity levels and escalation paths based on the impact of the event.
   • DConfigure alerts to only fire during business hours to reduce after-hours notifications.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which AWS service is specifically designed to record API activity for audit and monitoring purposes?

   • AAmazon GuardDuty
   • BAWS Config
   • CAWS CloudTrail
   • DAmazon CloudWatch
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company uses a third-party SIEM to monitor their cloud environment. They are experiencing delays in receiving alerts because the SIEM ingests data in batches. They need to reduce the time to detect security incidents. What is the most effective way to achieve this?

   • AManually check the SIEM dashboard more frequently.
   • BUse the cloud provider's native monitoring tools for real-time alerts and ignore the SIEM.
   • CIncrease the batch size and frequency of data ingestion.
   • DConfigure the SIEM to use real-time streaming ingestion from cloud APIs instead of batch processing.
   Reveal Solution Discussion Select an answer first