Continuous Security Monitoring Strategies CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of configuring alerting rules in a cloud monitoring system?

   • ATo notify appropriate personnel when specific conditions or thresholds are met
   • BTo automatically remediate security incidents
   • CTo replace the need for log storage
   • DTo encrypt all data in transit
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team wants to monitor user behavior and detect compromised accounts in their cloud environment. They have access to authentication logs, API activity logs, and network flow logs. Which combination of data sources would be most effective for this purpose?

   • AAuthentication logs and API activity logs to identify unusual login patterns and subsequent actions.
   • BAPI activity logs only, to see all actions taken by users.
   • CNetwork flow logs only, to analyze traffic patterns for anomalies.
   • DAuthentication logs only, to track login attempts and failures.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a common data source used for continuous security monitoring in cloud environments?

   • ANetwork flow logs
   • BApplication source code repositories
   • CEmployee performance reviews
   • DMarketing analytics dashboards
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team is struggling with a high volume of false positives from their continuous monitoring system, leading to alert fatigue and missed real incidents. They have already tuned thresholds and refined baselines, but the problem persists. What is the most effective next step?

   • ADisable all alerts for 30 days to reset the system.
   • BImplement a feedback loop where analysts can mark alerts as false positives and use that data to improve detection rules.
   • CSwitch to a different monitoring tool that promises fewer false positives.
   • DIncrease the severity threshold for all alerts to reduce the number of notifications.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security operations center (SOC) uses a cloud-native monitoring solution that generates thousands of alerts daily. The team is overwhelmed and has missed a critical incident because it was buried in low-priority alerts. They want to improve their incident response effectiveness. What should they do first?

   • AImplement alert triage and correlation rules to group related alerts and prioritize them based on business impact.
   • BIncrease the severity threshold for all alerts so only the most critical events trigger notifications.
   • CDisable all alerts that have not triggered an incident in the past month.
   • DAssign two analysts to manually review every alert to ensure nothing is missed.
   Reveal Solution Discussion Select an answer first