Enterprise Visibility and Incident Scoping GEIR Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of incident scoping?

   • ATo determine the full extent of the incident, including affected systems and data
   • BTo delete all logs related to the incident
   • CTo assign blame to responsible parties
   • DTo immediately contain the incident without further analysis
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a data source that provides authentication activity across an enterprise?

   • ADNS query logs
   • BVulnerability scanner reports
   • CNetFlow records
   • DActive Directory domain controller logs
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which technique involves examining events in chronological order to understand the sequence of an attack?

   • AMemory forensics
   • BThreat hunting
   • CLog correlation
   • DTimeline analysis
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which of the following best describes the three primary layers of an enterprise visibility architecture?

   • APerimeter, core, and edge
   • BNetwork, host, and application
   • CDetection, response, and recovery
   • DPhysical, virtual, and cloud
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   An organization wants to detect lateral movement between internal subnets. They currently have NetFlow enabled on core routers but no full packet capture. What is the most significant limitation of using only NetFlow for this detection?

   • ANetFlow cannot be used for historical analysis
   • BNetFlow cannot reveal the content of the traffic
   • CNetFlow does not include internal IP addresses
   • DNetFlow is only available on internet-facing interfaces
   Reveal Solution Discussion Select an answer first