Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager wants to measure the effectiveness of the threat intelligence integration into the SOC's detection and response processes. The manager has implemented a new intelligence feed and updated detection rules. Which metric would most directly indicate whether the intelligence is improving detection effectiveness?

   • AThe number of intelligence feeds subscribed to by the SOC.
   • BThe average time analysts spend researching each alert.
   • CThe percentage of confirmed alerts that were triggered by intelligence-based detection rules.
   • DThe total volume of alerts generated by the SIEM per day.
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A SOC manager needs to provide the executive team with a report on the top cyber threats facing the organization over the next year. Which type of threat intelligence is most appropriate for this audience?

   • AStrategic intelligence, such as analysis of adversary motivations and long-term trends.
   • BTactical intelligence, such as the specific tools and techniques used by adversaries.
   • COperational intelligence, such as details of specific attack campaigns.
   • DTechnical intelligence, such as lists of malicious IP addresses and hashes.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC manager is leading a threat modeling exercise for a critical application that will be accessible from the internet. The application uses a microservices architecture with multiple internal services communicating over a private network. The team has limited budget and must prioritize security controls. The threat model identifies that an attacker could compromise one microservice and then pivot to others. Which control should the team prioritize to contain this risk?

   • AIncrease logging and monitoring for all microservices to detect lateral movement after it occurs.
   • BUse a single shared service account for all microservices to simplify management and reduce operational overhead.
   • CImplement mutual TLS (mTLS) between microservices and enforce least-privilege network policies that only allow specific service-to-service communication.
   • DDeploy a web application firewall (WAF) in front of the application to block common web attacks.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager is explaining the concept of defense-in-depth to a new analyst. The manager uses the example of a web application that is protected by a WAF, network segmentation, and host-based intrusion detection. The analyst asks why multiple layers are needed if the WAF is already in place. Which response best explains the value of defense-in-depth?

   • AMultiple layers make the network slower, which deters attackers from targeting the organization.
   • BMultiple layers ensure that if one control fails or is bypassed, other controls can still detect or prevent the attack.
   • CMultiple layers are required to meet compliance regulations, even if they do not improve security.
   • DMultiple layers are needed because the WAF can only protect against known signatures and cannot stop any other type of attack.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does the zero trust model affect SOC operations?

   • AIt simplifies SOC operations by reducing the number of security tools needed.
   • BIt eliminates the need for continuous monitoring because access is already verified.
   • CIt shifts the SOC's focus from detection to prevention only.
   • DIt requires the SOC to monitor and verify every access attempt, increasing the volume of security events.
   Reveal Solution Discussion Select an answer first