Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security manager wants to categorize the defensive technologies currently deployed. The organization uses a firewall, an IDS, a SIEM, and endpoint antivirus. Which categorization correctly groups these technologies by their primary function?

   • AAll four are primarily identity and access management technologies.
   • BAll four are primarily encryption technologies.
   • CFirewall: detection; IDS: network control; SIEM: endpoint protection; antivirus: monitoring.
   • DFirewall: network control; IDS: detection; SIEM: monitoring and analysis; antivirus: endpoint protection.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat intelligence analyst receives a feed that includes a large number of IOCs, but many are false positives and the feed has a high volume. The analyst wants to use the intelligence to prioritize defenses without overwhelming the SOC. Which approach is most effective?

   • AForward all IOCs to the SOC for manual review.
   • BCorrelate the IOCs with internal logs and prioritize those that match internal assets or recent activity.
   • CIgnore the feed because it has false positives.
   • DBlock all IOCs immediately in the firewall without validation.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's mobile workforce uses laptops that contain sensitive customer data. The laptops are occasionally lost or stolen. The company wants to ensure that the data on the laptops is unreadable if the device is stolen, and that only authorized users can access the data. Which control is most effective?

   • AStore all sensitive data in a cloud service and keep nothing on the laptop.
   • BEnable full-disk encryption on the laptops and require a strong password or PIN to unlock the device.
   • CUse a BIOS password to prevent the laptop from booting.
   • DUse a remote wipe feature that can erase the laptop if it is reported stolen.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's finance team handles sensitive payroll data. The security policy requires that users authenticate with something they know and something they have, and that they only have access to the specific records needed for their job. Which set of controls implements this policy?

   • AUse a username and password plus a one-time code from an authenticator app, and assign role-based access permissions.
   • BUse a smart card and PIN for authentication, and grant all finance users access to all payroll records.
   • CUse a single sign-on (SSO) system with a strong password, and restrict access based on IP address.
   • DUse biometric authentication (fingerprint) and a complex password, and give users full control over their own records.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst notices repeated SQL injection attempts against a web application. The attempts are blocked by the web application firewall, but the analyst wants to understand the full scope of the attacks, including source IPs, payload variations, and whether any attempts evaded the WAF. Which control is most appropriate to provide this visibility?

   • AConfigure a SIEM to collect and correlate logs from the WAF, web server, and firewall.
   • BInstall a network-based intrusion detection system (IDS) on the same segment as the web server.
   • CDeploy an intrusion prevention system (IPS) inline in front of the web server.
   • DEnable verbose logging on the web server and review the logs manually.
   Reveal Solution Discussion Select an answer first