Security Architecture Overview GMON Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is planning to implement continuous monitoring for a new cloud-based application. The application uses a load balancer, virtual machines, and a managed database. Which set of data sources should be integrated into the SIEM to provide comprehensive monitoring?

   • AOnly the database audit logs, since the database contains the most sensitive data.
   • BOnly the VM operating system logs, since they contain security events.
   • COnly the load balancer access logs, since they capture all user requests.
   • DLoad balancer access logs, VM operating system logs, and database audit logs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which security architecture framework is specifically designed to align business goals with security architecture and risk management, using a layered approach that includes business, architecture, and operational views?

   • ATOGAF
   • BNIST Cybersecurity Framework
   • CSABSA
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is configuring a SIEM to detect a known malware signature that is present in network traffic. The team has an IDS and a firewall. Which component should be the primary source of data for this detection?

   • AFirewall logs
   • BIDS alerts
   • CEndpoint protection logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is investigating a suspicious outbound connection from a workstation to an unknown IP address. The team has firewall logs, DNS logs, and endpoint protection logs. Which combination of data would provide the most complete picture of the connection?

   • ADNS logs only
   • BEndpoint protection logs only
   • CFirewall logs only
   • DFirewall logs to confirm the connection, DNS logs to identify the domain, and endpoint logs to see the process
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying a new application and wants to ensure that monitoring covers all layers of the security architecture. The application runs on a server in a data center, uses a database, and is accessed by users over the internet. Which combination of monitoring sources provides the most comprehensive coverage?

   • ANetwork flow logs and application logs only
   • BPhysical access logs, network flow logs, host logs, and application logs
   • CHost logs and database logs only
   • DFirewall logs and IDS alerts only
   Reveal Solution Discussion Select an answer first