Continuous Security Monitoring Strategies CSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is overwhelmed by false-positive alerts from their continuous monitoring system. They have a limited budget and cannot hire more analysts. They want to reduce noise without missing real threats. Which approach is most effective?

   • AIncrease the severity threshold so only high-severity alerts are generated.
   • BDisable all alerts and rely on periodic manual log reviews.
   • CPurchase a more expensive SIEM that claims to have better detection algorithms.
   • DTune detection rules using historical data to better match the environment's normal behavior, and suppress alerts that are known to be benign.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of establishing a baseline in continuous security monitoring?

   • ATo define the expected normal behavior of the environment so that deviations can be detected
   • BTo store historical logs for compliance purposes
   • CTo automatically block all unusual activity
   • DTo replace the need for real-time monitoring
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A cloud security team is configuring continuous monitoring for a new application. They are concerned about the volume of log data and the cost of storing it. They also need to detect anomalies in real time. What is the most effective strategy?

   • AUse a third-party SIEM that ingests all logs and provides real-time alerts, regardless of cost.
   • BStore all logs in a hot storage tier for immediate access and analysis.
   • CStream critical logs to a real-time analytics service and archive less critical logs to low-cost storage for later analysis.
   • DDisable logging for non-critical components to reduce data volume.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's security team is configuring continuous monitoring for their cloud environment. They are receiving a high number of false positive alerts from their anomaly detection system, causing alert fatigue. They want to reduce false positives without missing real threats. What should they do?

   • ATune the anomaly detection thresholds and refine the baseline using historical data that reflects normal behavior patterns.
   • BIncrease the alert severity level for all anomaly alerts so only the most severe are sent.
   • CSend all alerts to a separate email address so they do not disturb the main security team.
   • DDisable anomaly detection alerts and rely on signature-based detection only.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What type of report is commonly generated from continuous monitoring data for management review?

   • ASecurity posture summary
   • BMarketing performance report
   • CFinancial balance sheet
   • DEmployee satisfaction survey
   Reveal Solution Discussion Select an answer first