Asset and Network Analytics GCDA Practice Questions (Page 11)

Questions 51–52

1. 51foundation · easy

   Which asset would typically be classified as high criticality?

   • AA guest Wi-Fi access point
   • BA printer in a break room
   • CA domain controller that authenticates all users
   • DA development test server with no production data
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A detection analyst is configuring a SIEM to enrich network alerts with threat intelligence. The analyst wants to reduce false positives while still detecting known malicious activity. Which approach is most effective?

   • AUse threat intelligence to enrich alerts that are already triggered by other analytics, and prioritize those with high-confidence indicators.
   • BOnly use threat intelligence from a single free feed to avoid noise.
   • CBlock all IPs from the threat intelligence feed at the firewall.
   • DCreate alerts for any connection to any IP in the threat intelligence feed.
   Reveal Solution Discussion Select an answer first