Continuous Security Monitoring Strategies CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common challenge in continuous security monitoring?

   • AInability to collect any logs
   • BNo need for baselines
   • CLack of available monitoring tools
   • DHigh volume of data leading to alert fatigue
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does continuous monitoring support compliance requirements?

   • ABy eliminating the need for external audits
   • BBy automatically passing all compliance audits
   • CBy providing evidence of ongoing security controls and generating audit-ready reports
   • DBy encrypting all compliance data
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs a multi-account AWS environment. The security team needs a single view of all API activity across accounts, including who made changes and when, and wants alerts when specific high-risk actions occur. They already have AWS CloudTrail enabled in each account. What should they do to centralize this monitoring?

   • ACreate an organization trail in AWS Organizations that delivers logs to a central S3 bucket and configure Amazon EventBridge rules to send alerts for high-risk actions.
   • BPoint each account's CloudTrail to the same S3 bucket and use AWS CloudWatch Logs Insights to query across accounts.
   • CUse AWS Trusted Advisor to monitor API activity and send notifications through AWS Health Dashboard.
   • DEnable AWS Config in each account and use the AWS Config console to view all API activity and set up config rules for alerting.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a continuous monitoring system that generates alerts for suspicious activities. The SOC is overwhelmed by the volume of alerts and has missed a critical incident. They want to improve their incident response process. What is the most effective way to integrate continuous monitoring with incident response?

   • ADisable alerts for low-risk events to reduce volume.
   • BUse a single dashboard to display all alerts without any filtering.
   • CImplement automated correlation and enrichment of alerts to reduce noise and provide context for triage.
   • DIncrease the number of SOC analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company must comply with a regulation that requires continuous monitoring of access to sensitive data and the ability to produce reports for auditors on demand. They use a multi-cloud environment. What is the most effective way to meet this requirement?

   • AManually collect logs from each provider and compile reports as needed.
   • BUse each cloud provider's native monitoring tools and generate separate reports for each.
   • CStore all logs in a single cloud provider's storage and use that provider's reporting tools.
   • DUse a centralized logging and SIEM solution that collects audit logs from all cloud providers and provides reporting capabilities.
   Reveal Solution Discussion Select an answer first