Cyber Defense Principles GMON Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is investigating a potential data breach. The analyst has access to logs from the firewall, the authentication server, and the file server. The analyst notices that a user account was used to access a sensitive file at the same time the user was on vacation. Which action is most appropriate?

   • ANotify the user's manager and ask if the user was actually on vacation.
   • BCorrelate the logs to determine the source IP address and the method of authentication used.
   • CIgnore the alert because the user was on vacation and could not have accessed the file.
   • DImmediately disable the user account and reset the password.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial institution is implementing a new monitoring system. The risk team has identified that the highest-impact risk is a compromised administrator account that could be used to transfer funds. The security team must choose a control to mitigate this risk. Which control most directly reduces the likelihood of this specific risk?

   • ARequire multi-factor authentication for all administrator accounts.
   • BConduct quarterly security awareness training for all employees.
   • CDeploy an intrusion detection system on the network perimeter.
   • DIncrease the frequency of full-disk backups for the monitoring system.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security engineer is designing a network for a new office. The engineer wants to ensure that if an attacker compromises a workstation, they cannot easily access the finance department's systems. Which design best applies the principle of defense-in-depth?

   • AEnable full disk encryption on all workstations.
   • BInstall a network intrusion detection system (IDS) to monitor for suspicious activity.
   • CUse a single flat network with strong passwords on all systems.
   • DSegment the network into separate VLANs for different departments and use firewalls to control traffic between them.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security architect is designing a monitoring solution for a healthcare organization that must comply with data privacy regulations. The organization wants to detect unauthorized access to patient records while minimizing the risk of exposing sensitive data in logs. Which approach best balances these requirements?

   • ALog access events with user identifiers and timestamps, but mask or redact the patient data fields in the logs.
   • BLog access events only for users outside the organization, since internal users are trusted.
   • CLog full patient records in the SIEM to enable thorough investigation of any access.
   • DDo not log access to patient records to avoid any risk of data exposure.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is implementing a least privilege policy for its development team. Developers need access to production logs to troubleshoot issues, but should not be able to modify production code or configuration. Which approach best meets these requirements?

   • AGrant developers write access to production configuration files so they can fix issues quickly.
   • BGive developers full administrative access to production servers so they can troubleshoot more effectively.
   • CGrant developers read-only access to production logs through a centralized logging system, and require them to use a separate account for production access.
   • DAllow developers to use their regular accounts to access production logs and code.
   Reveal Solution Discussion Select an answer first