Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What type of network data is generated by NetFlow or IPFIX?

   • AFlow records summarizing communication sessions
   • BFull packet contents
   • CApplication-layer logs
   • DSecurity alerts from an IDS
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is a potential impact of a visibility gap on incident scoping?

   • AThe incident may be underestimated or missed entirely
   • BIt only affects the documentation phase
   • CThe incident response team will always overestimate the scope
   • DIt has no impact on scoping
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company runs workloads in a cloud environment. During an incident, the incident response team needs to determine which API calls were made by a compromised service account. Which data source would provide the most direct evidence of these API calls?

   • ACloud provider's API activity logs (e.g., CloudTrail)
   • BVirtual network flow logs
   • CHost-based firewall logs
   • DEDR alerts on the virtual machines
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   An organization has deployed EDR on all endpoints and has network flow logs from the perimeter. During an incident, they notice that a compromised endpoint is communicating with an internal server on port 445 (SMB). The EDR does not show any suspicious process on the endpoint. What is the most likely visibility gap?

   • ANo network flow logs for internal traffic
   • BNo visibility into the internal server's endpoint activity
   • CNo DNS logs
   • DNo application logs from the SMB service
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is an example of an application-layer data source in an enterprise visibility architecture?

   • AWeb server access logs
   • BWindows Security event logs
   • CPacket captures from a network tap
   • DNetFlow records from a router
   Reveal Solution Discussion Select an answer first