Continuous Security Monitoring Strategies CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is investigating a potential security incident. They need to determine what an attacker did after compromising a virtual machine. Which monitoring data source would provide the most detailed evidence of the attacker's actions on the VM?

   • AOperating system audit logs and command-line activity logs from the VM.
   • BCloud provider API logs (e.g., CloudTrail) for the VM's lifecycle events.
   • CNetwork flow logs showing connections to and from the VM.
   • DCloud provider's health metrics for the VM (CPU, memory).
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a mature continuous monitoring system that generates many alerts. The incident response team is small and must prioritize which alerts to investigate first. Which factor should be the primary driver for prioritization?

   • AThe ease of investigating the alert.
   • BThe order in which alerts are received.
   • CThe number of alerts generated by the same rule.
   • DThe potential impact of the alert on critical business systems and data.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement best describes the role of continuous monitoring in maintaining security posture?

   • AIt provides a one-time snapshot of security controls at deployment
   • BIt focuses only on external threats, ignoring internal misconfigurations
   • CIt eliminates the need for incident response planning
   • DIt enables ongoing assessment of security controls and rapid identification of changes or threats
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is configuring alert notifications for a cloud environment. They have a 24/7 operation but limited staff. They want to ensure that critical alerts are acknowledged and handled, but they also want to avoid alert fatigue. Which strategy is most effective?

   • ASend all alerts to a single email distribution list and hope someone responds.
   • BOnly send alerts during business hours and ignore off-hours alerts.
   • CImplement an escalation policy where critical alerts page the on-call engineer, and if not acknowledged within 10 minutes, escalate to the next tier.
   • DCreate a separate Slack channel for each alert type and require all team members to monitor all channels.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is setting up anomaly detection for a cloud environment. They have collected metrics on CPU utilization, network traffic, and user login frequency over the past 90 days. The environment has predictable weekly patterns. What is the most effective way to establish a baseline for these metrics?

   • AUse the 90-day average as the baseline and alert when a metric deviates by more than 20% from that average.
   • BTake the most recent 7 days of data as the baseline and update it daily.
   • CSegment the data by time of day and day of week, then calculate separate baselines for each segment.
   • DUse the minimum observed value as the baseline and alert on any increase above that minimum.
   Reveal Solution Discussion Select an answer first