Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC manager is designing a logging architecture for a large enterprise. The requirement is to detect advanced threats that may use legitimate credentials. The SOC has limited storage and must prioritize which logs to collect. Which approach best balances visibility and storage constraints?

   • ACollect only firewall logs and store them for 30 days.
   • BCollect logs only when an incident is suspected.
   • CCollect and store all logs from all sources for one year.
   • DCollect authentication logs, endpoint logs, and network metadata, and store them for a period that balances cost and investigation needs.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC manager is designing a logging and monitoring architecture for a hybrid environment with on-premises servers and cloud workloads. The manager must ensure comprehensive visibility while managing storage costs and meeting a regulatory requirement to retain logs for one year. The team has limited staffing for log management. Which approach best balances these constraints?

   • ACollect high-value logs (authentication, endpoint, network) into the SIEM for real-time analysis, and archive all logs to low-cost object storage for the one-year retention period.
   • BCollect all logs from all sources and store them in a hot SIEM storage tier for one year to ensure immediate searchability.
   • CStore logs locally on each device and only collect them into the SIEM when an incident occurs.
   • DCollect only cloud logs and ignore on-premises logs to reduce complexity and cost.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager is redesigning the network for a mid-sized financial services firm. The firm's applications are distributed across multiple VLANs, and the security team has observed that once an attacker compromises a single workstation, they are able to move laterally to the database tier within minutes. The manager wants to implement a segmentation strategy that will most directly impede lateral movement while minimizing disruption to existing application flows. Which approach should the manager prioritize?

   • AIncrease logging verbosity on all servers and enable Windows event collection to better detect lateral movement after it occurs.
   • BDeploy a next-generation firewall at the internet edge and enable intrusion prevention on all inbound traffic.
   • CConsolidate all application tiers onto a single flat VLAN to simplify monitoring and reduce the number of firewall rule sets to manage.
   • DImplement micro-segmentation between application tiers using host-based firewalls and allow only specific ports and protocols required for each communication path.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC manager is explaining to the CISO why the SOC needs to implement both preventive and detective controls. The CISO asks why the company cannot rely solely on strong preventive controls. Which response best justifies the need for detective controls?

   • ANo preventive control is perfect, so detective controls provide visibility to detect and respond to failures or bypasses.
   • BPreventive controls are always bypassed by sophisticated attackers.
   • CDetective controls are required by law in all industries.
   • DDetective controls are cheaper than preventive controls.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is moving to a zero trust architecture and wants to ensure that its SOC has the visibility needed to enforce continuous verification. The company has a mix of on-premises servers and cloud applications accessed by employees from various locations. Which combination of controls will best support zero trust principles while providing the SOC with the necessary data?

   • AImplement conditional access policies that evaluate user identity, device health, and location for every access request, and route all access logs to the SIEM for continuous monitoring.
   • BRequire multi-factor authentication (MFA) for all remote access and rely on the VPN logs to monitor user activity.
   • CDeploy a traditional perimeter firewall and assume that all internal traffic is trusted once the user authenticates to the network.
   • DUse a single sign-on (SSO) solution and disable MFA to reduce friction, while relying on the identity provider's audit logs.
   Reveal Solution Discussion Select an answer first