Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company wants to improve its visibility architecture to detect advanced threats that use encrypted communication. They currently have network flow logs, EDR, and DNS logs. What additional capability would be most effective?

   • AAdditional EDR sensors on endpoints
   • BSSL/TLS interception or decryption at the network perimeter
   • CMore storage for flow logs
   • DMore DNS logging
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is migrating to a cloud environment and wants to maintain visibility for incident response. They are concerned about the cost of storing all logs and the need to investigate historical incidents. They decide to enable API activity logging (e.g., CloudTrail) and virtual network flow logs. What is the most important consideration for ensuring these logs are useful for incident scoping?

   • AEnsure logs are exported to a centralized storage that is immutable and has sufficient retention
   • BStore logs only in the cloud provider's default log service
   • CEnable logging only for production workloads to reduce cost
   • DDisable logging for read-only API calls to save space
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team collects logs from firewalls, EDR, and Active Directory into a central SIEM. During an incident, they need to search for all events related to a specific user account across all three sources. What is the most important requirement for this search to be effective?

   • ALogs must be normalized to a common schema
   • BLogs must be collected in real time
   • CLogs must be encrypted at rest
   • DLogs must be stored for at least one year
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scoping technique involves proactively searching for indicators of compromise across the environment?

   • AThreat hunting
   • BPacket capture analysis
   • CLog correlation
   • DTimeline analysis
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An incident responder is scoping a ransomware outbreak. The team has identified 10 encrypted servers. The responder wants to determine if the ransomware spread to other servers that are not yet encrypted. Which action is most appropriate for scoping?

   • AOnly document the 10 encrypted servers and ignore the rest
   • BWait for more servers to be encrypted before taking action
   • CSearch for the ransomware's known indicators of compromise (IOCs) across all server logs
   • DImmediately shut down all servers to prevent spread
   Reveal Solution Discussion Select an answer first