Blue Team Defense Concepts GSOC Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   A company is deploying a new security monitoring architecture. They have a limited budget and need to monitor both network traffic and endpoint activity. They are considering two options: (1) a network-based IDS that inspects all traffic, and (2) an EDR solution on all endpoints. The company's primary concern is detecting advanced threats that use encrypted communication channels. Which approach is MORE effective for this specific concern?

   • AThe network-based IDS, because it can decrypt traffic using a man-in-the-middle proxy.
   • BThe EDR solution, because it can inspect process behavior and memory before encryption is applied.
   • CBoth are equally effective, as they both see the same data.
   • DNeither is effective, as encrypted traffic cannot be monitored at all.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security architect is designing a defense-in-depth strategy for a web application. The application is behind a web application firewall (WAF), and the servers have endpoint protection. The architect wants to add a layer that can detect anomalous behavior within the application's database queries. Which control best fulfills this requirement?

   • ADatabase Activity Monitoring (DAM)
   • BNetwork Intrusion Detection System (NIDS)
   • CHost Intrusion Prevention System (HIPS)
   • DSecurity Information and Event Management (SIEM)
   Reveal Solution Discussion Select an answer first