Security Architecture Overview GMON Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing the architecture of a web application. The application is protected by a web application firewall (WAF), and the backend database is only accessible from the application servers. The analyst wants to add a component that can detect and alert on anomalous database queries that might indicate SQL injection. Which component should be added?

   • AA SIEM that collects application logs and correlates them with network traffic.
   • BA database activity monitoring (DAM) system that analyzes SQL queries and alerts on anomalies.
   • CAn endpoint detection and response (EDR) agent on the database server.
   • DA network-based IDS placed between the application servers and the database.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a flat network and wants to implement segmentation to improve security and monitoring. The security team wants to detect lateral movement, but the business requires that some servers be accessible from multiple zones. Which design pattern best balances these needs?

   • AUse VLANs without firewalls
   • BKeep the flat network and rely on host-based firewalls
   • CCreate a single DMZ for all servers
   • DCreate separate zones for each trust level and place firewalls between them, with monitoring on each firewall
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security architect is designing a monitoring architecture for a multi-site organization. The requirement is to have a centralized view of all security events while ensuring that each site can continue to operate independently if the central connection fails. Which approach best meets this requirement?

   • ASend all logs directly to a single central SIEM and disable local alerting to avoid duplication.
   • BStore logs locally at each site and only review them monthly for compliance.
   • CDeploy a SIEM at each site and forward logs to a central SIEM, with local alerting enabled at each site.
   • DUse a cloud-based SIEM and require all sites to have a reliable internet connection at all times.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is troubleshooting a series of alerts from their SIEM. The SIEM is receiving logs from a network IDS, a host-based EDR, and a WAF. The team notices that the IDS generates many false positives, the EDR misses some attacks because it is not fully deployed, and the WAF is only protecting one application. Which action would most effectively improve the overall detection capability?

   • ADisable the IDS and rely solely on the EDR, since host-based detection is more accurate.
   • BIncrease the sensitivity of the IDS to catch more attacks, even if it means more false positives.
   • CReplace the WAF with a second IDS to reduce costs and simplify management.
   • DTune the IDS rules to reduce false positives, complete the EDR deployment, and expand WAF coverage to all web applications.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is reviewing its monitoring architecture. They have a SIEM that collects logs from firewalls, IDS, and endpoint protection. The team wants to detect an attacker who has moved laterally within the internal network. Which additional data source would most directly improve detection of lateral movement?

   • APhysical access logs
   • BAuthentication logs from domain controllers
   • CWeb proxy logs
   • DDNS query logs
   Reveal Solution Discussion Select an answer first