Security Architecture Overview GMON Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is investigating a potential breach. The SIEM shows a series of failed logins followed by a successful login from an unusual IP address. The team wants to determine whether the attacker gained access to a specific file server. Which additional data source would provide the most direct evidence?

   • ADNS logs
   • BIDS alerts
   • CFirewall logs
   • DFile server audit logs
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which security architecture layer is primarily concerned with controlling access to the network infrastructure, such as routers, switches, and wireless access points?

   • APhysical layer
   • BData layer
   • CApplication layer
   • DNetwork layer
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does a well-designed security architecture directly support continuous monitoring?

   • ABy identifying the critical assets and data flows, which determines what should be monitored and where data should be collected
   • BBy defining the specific security controls to be implemented, which eliminates the need for monitoring
   • CBy automating all incident response actions, so manual monitoring is unnecessary
   • DBy providing a static set of rules that never change, ensuring consistent monitoring
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security architect is adopting SABSA to align security architecture with business goals. The architect needs to define what to monitor and where to collect data for a new business service. Which SABSA layer should the architect consult first to understand the business requirements for monitoring?

   • APhysical layer
   • BConceptual layer
   • CContextual layer
   • DLogical layer
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is designing monitoring for a cloud-based application. The application runs on virtual machines in a public cloud. The team wants to monitor the application layer and the host layer. Which combination of monitoring sources is most appropriate?

   • ACloud provider's physical server logs
   • BCloud provider's access logs for the management console
   • CApplication logs from the application and guest OS logs from the VMs
   • DNetwork flow logs from the cloud provider's hypervisor
   Reveal Solution Discussion Select an answer first