Monitoring and Logging ECDE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company must comply with GDPR, which requires that personal data be protected and that data subjects can request deletion of their data. They store logs that may contain personal data. How should they handle logging to meet GDPR requirements?

   • AImplement a data retention policy that automatically deletes or anonymizes personal data in logs after a defined period.
   • BEncrypt logs and store them in a secure location.
   • CStore all logs indefinitely to ensure availability for audits.
   • DAvoid logging any personal data at all times.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of a security anomaly that could be detected through monitoring?

   • AA scheduled backup completing successfully
   • BA regular user logging in during business hours
   • CA decrease in CPU usage during off-peak hours
   • DA sudden spike in outbound network traffic from a server
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team wants to detect data exfiltration by monitoring outbound network traffic. Which monitoring approach would be most effective?

   • AMonitor CPU usage on the firewall.
   • BReview application logs for error messages.
   • CTrack the number of user logins per day.
   • DAnalyze NetFlow or similar flow logs to identify large or unusual outbound transfers.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   During an incident, the monitoring system generates a high volume of alerts, many of which are false positives. The incident response team is overwhelmed. What should they do to improve the situation?

   • ADisable all alerts until the incident is resolved.
   • BAssign more people to manually review each alert.
   • CTune alert rules to reduce false positives and group related alerts into incidents.
   • DIncrease the alert threshold for all metrics to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During a security incident, the incident response team needs to determine the scope of a data breach. Which source of information would be MOST useful for reconstructing the attacker's actions?

   • AMemory dumps from all servers taken after the incident.
   • BA summary report of the incident written by the help desk.
   • CCentralized logs from authentication, network, and application systems with timestamps.
   • DCurrent system configuration files.
   Reveal Solution Discussion Select an answer first