Continuous Monitoring Tools DSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization must demonstrate that only authorized personnel have accessed patient data. They have a SIEM that collects application logs. What additional monitoring practice is essential?

   • APerform regular vulnerability scans on the application
   • BBack up logs to an external drive weekly
   • CImplement user activity monitoring that correlates authentication events with data access logs
   • DMonitor network bandwidth usage to detect data exfiltration
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key metric used to detect anomalies in system performance?

   • ANumber of open issues
   • BNumber of code commits
   • CNumber of developers on the team
   • DCPU utilization
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company must provide audit evidence that their monitoring system is working correctly. They have a SIEM that collects logs from all critical systems. Which practice best demonstrates the effectiveness of continuous monitoring to an auditor?

   • AShow the auditor the SIEM dashboard with current alerts.
   • BProvide the SIEM's user manual to the auditor.
   • CState that the monitoring system is 'always on'.
   • DRegularly test alerting mechanisms by generating synthetic events and documenting the results.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise runs a hybrid infrastructure with on-premises servers and cloud VMs. They use a SIEM for log aggregation, but the SIEM's storage is limited and expensive. They need to retain logs for 2 years for compliance, but also need to search logs quickly for incident response. They are considering a tiered storage strategy. Which approach best balances cost and performance?

   • ADelete logs older than 30 days and rely on summary reports for compliance
   • BStore all logs in the SIEM's hot storage for 2 years
   • CUse the SIEM's hot storage for recent logs (e.g., 30 days) and archive older logs to a low-cost object store with a searchable index
   • DArchive all logs to cold storage and only use the SIEM for real-time alerts
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A startup wants to implement continuous monitoring for their cloud infrastructure but has a limited budget. They need to collect metrics, visualize them, and receive alerts. Which approach is most cost-effective among the listed options?

   • AUse open-source tools like Prometheus and Grafana hosted on a small VM.
   • BPurchase a commercial monitoring suite with full support.
   • CUse a cloud provider's managed monitoring service with pay-as-you-go pricing.
   • DBuild a custom monitoring solution from scratch.
   Reveal Solution Discussion Select an answer first