Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   Why is it important to collect security data from diverse sources (e.g., network, endpoint, cloud) into a central platform?

   • ATo reduce the volume of data by selecting only the most important source.
   • BTo comply with data sovereignty by keeping data in separate regions.
   • CTo enable correlation of events across different layers of the environment.
   • DTo ensure that each source has its own independent monitoring system.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A SOC manager is leading a threat modeling exercise for a new web application that will handle sensitive customer data. The application is deployed in a public cloud and uses a load balancer, application servers, and a database. The team wants to identify the most likely attack paths and prioritize security investments. Which approach should the team take?

   • AAsk the developers to describe the application's features and then purchase additional security tools based on their recommendations.
   • BRun a vulnerability scanner against the application and fix all high-severity vulnerabilities without considering the attack paths.
   • CUse the STRIDE model to systematically identify threats such as spoofing, tampering, and information disclosure, then map them to the application's data flows and trust boundaries.
   • DReview the application's source code for common coding errors and deploy a web application firewall (WAF) to block all suspected attacks.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which principle of defensible architecture is most directly applied when a SOC restricts analyst access to only the specific tools and data required for their role?

   • AFail-secure
   • BSegmentation
   • CDefense-in-depth
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   A SOC manager is evaluating the SOC's performance. The SOC has a high number of alerts, but the team spends most of its time investigating false positives. The manager wants to improve the SOC's efficiency. Which metric should the manager focus on improving?

   • ANumber of threat intelligence feeds
   • BFalse positive rate
   • CAlert volume
   • DMean time to detect (MTTD)
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A SOC manager is designing a logging architecture for a new cloud-based application that spans multiple AWS accounts and uses serverless functions, containers, and managed databases. The manager wants to ensure comprehensive visibility for threat detection while keeping operational overhead manageable. Which approach best meets these requirements?

   • AStore logs locally on each serverless function's ephemeral storage and have developers manually review them weekly.
   • BUse only the managed database's native audit logs and rely on the cloud provider's default monitoring dashboards for everything else.
   • CConfigure CloudTrail, VPC Flow Logs, and application-level logging for serverless functions and containers, then centralize all logs into a single SIEM platform with normalization rules.
   • DEnable CloudTrail in each account and stream all logs to a central S3 bucket, but do not enable any other logging because CloudTrail covers all API activity.
   Reveal Solution Discussion Select an answer first