Continuous Security Monitoring Strategies CSE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security operations team uses a SIEM to monitor cloud activity. They want to ensure that critical alerts are not missed during off-hours. Which notification strategy is most effective?

   • ARely on the SIEM dashboard to show alerts when someone logs in.
   • BConfigure the SIEM to send critical alerts to a dedicated on-call phone via SMS and email, with an escalation policy if not acknowledged.
   • CPost alerts to a public Slack channel that anyone can view.
   • DSend all alerts to a shared email inbox that is checked during business hours only.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security analyst is configuring anomaly detection for a cloud environment that experiences seasonal traffic patterns (e.g., higher load during holidays). The analyst wants to avoid false positives during peak seasons. What is the best approach?

   • ADisable anomaly detection during known peak seasons.
   • BUse a baseline that accounts for seasonal variations by comparing current activity to the same period in previous cycles.
   • CUse a single annual average baseline for all metrics.
   • DSet a very high threshold to avoid any alerts during peak seasons.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company must demonstrate to regulators that it continuously monitors for unauthorized access to its cloud resources. Which practice best supports this compliance requirement?

   • APerform a quarterly manual review of access logs.
   • BStore logs but do not analyze them until an incident occurs.
   • CImplement automated collection and analysis of security logs, and generate regular compliance reports from that data.
   • DRely on the cloud provider's security certifications to satisfy the requirement.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A financial services company must provide evidence to regulators that they continuously monitor for unauthorized access to their cloud resources. They use GCP and need to generate monthly compliance reports. What is the most effective way to meet this requirement?

   • AUse Cloud Security Command Center to view all security findings and generate a report.
   • BEnable Cloud Logging and manually copy logs to a local server each month.
   • CUse Cloud Audit Logs and Cloud Monitoring, and export logs to BigQuery for analysis and report generation.
   • DSet up Cloud Monitoring alerts for all API calls and use the alert history as a report.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a common notification channel used for security alerts?

   • ADHCP
   • BEmail
   • CDNS
   • DNTP
   Reveal Solution Discussion Select an answer first