Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC receives logs from multiple sources in different formats: firewall logs in CSV, Windows Event Logs in XML, and custom application logs in JSON. The SIEM is having difficulty correlating events across these sources. What is the most effective way to address this?

   • AConvert all logs to a single format before sending them to the SIEM.
   • BUse a different SIEM for each log format.
   • CManually review each log source separately and correlate events in a spreadsheet.
   • DConfigure the SIEM to parse and normalize each log source into a common data model.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is adopting a zero trust architecture. The SOC manager must ensure that the SOC can effectively monitor and respond to access attempts. Which change is most aligned with zero trust principles?

   • AImplement continuous verification of user and device identity for every access request, regardless of network location.
   • BIncrease logging of network traffic at the perimeter and review it weekly.
   • CRequire multi-factor authentication for all users, but keep the network perimeter as the primary trust boundary.
   • DMove all applications to the public cloud and rely on the cloud provider's identity management.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC manager is establishing a threat intelligence program. The manager wants to ensure that the intelligence produced is relevant to the organization's specific risks and that it directly improves detection and response. Which sequence of actions best aligns with the threat intelligence lifecycle?

   • ADefine intelligence requirements based on the organization's critical assets and threat model, then collect, process, analyze, and disseminate intelligence tailored to those requirements, and solicit feedback.
   • BPurchase a commercial threat feed and automatically block all indicators without any analysis or tailoring to the organization's environment.
   • CCollect as much data as possible from all available sources, process it into indicators, and disseminate the indicators to all staff without filtering.
   • DFocus exclusively on open-source intelligence and never share internal findings with information-sharing communities to protect confidentiality.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC manager is designing a logging architecture for a new application that will be deployed across multiple cloud and on-premises environments. The requirement is to ensure that all security-relevant events are available for correlation in a central location. Which design best meets this requirement?

   • AForward all logs from all sources to a central SIEM in near real-time, with a consistent schema for normalization.
   • BUse a separate SIEM for each environment and manually correlate findings.
   • COnly log authentication events and ignore application-level events to reduce noise.
   • DHave each environment store its logs locally and only forward them to the central SIEM during incident investigations.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What does 'attack surface analysis' focus on?

   • AMeasuring the performance of the SOC's incident response team.
   • BIdentifying all the ways an attacker could potentially enter or interact with a system.
   • CReviewing employee background checks for insider threat potential.
   • DAnalyzing the organization's public-facing marketing materials.
   Reveal Solution Discussion Select an answer first