Cyber Defense Theory, Threat Intel, and Defensible Architecture GSOM Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC manager is redesigning the network for a mid-sized company. The company's main concern is preventing an attacker who compromises a single workstation from moving laterally to the database servers. The SOC has limited budget and cannot replace existing switches. Which approach best meets the requirement?

   • ACreate separate VLANs for workstations, application servers, and database servers, and use ACLs on the core switch to allow only required traffic between them.
   • BImplement micro-segmentation by deploying a new next-generation firewall between every pair of servers.
   • CMove all database servers to a cloud environment and rely on the cloud provider's default security.
   • DPlace all servers in a single VLAN and restrict access with host-based firewalls on each server.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which architectural approach is most consistent with the principle of 'secure design' in a defensible architecture?

   • AUsing a single, monolithic security appliance for all functions
   • BRelying solely on perimeter firewalls to protect all internal systems
   • CAdding security controls after the system is fully deployed
   • DEmbedding security requirements into the design and development lifecycle from the start
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary goal of a logging and monitoring architecture in a SOC?

   • ATo replace the need for endpoint detection and response tools.
   • BTo provide comprehensive visibility into security-relevant events across the environment.
   • CTo store logs for compliance without analyzing them.
   • DTo reduce the amount of data collected to minimize costs.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which statement best describes the core principle of the zero trust model?

   • ATrust is based on the strength of the perimeter firewall.
   • BTrust is granted based on the network location of the user or device.
   • CTrust is never assumed; every access request is verified continuously.
   • DTrust is established once at login and then maintained for the session.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC manager wants to integrate threat intelligence into the alert triage process to reduce false positives and prioritize alerts based on relevance to the organization. The team currently receives thousands of raw alerts daily. The manager has access to a commercial threat intelligence feed that provides indicators of compromise (IOCs) and a government information-sharing community that provides tactical reports on adversary campaigns. Which integration approach will best improve triage efficiency?

   • AUse only the information-sharing reports to manually update detection rules once a month, and disregard the commercial feed because it contains too many false positives.
   • BAutomatically block all IP addresses from the commercial feed at the firewall and ignore the information-sharing reports because they are not machine-readable.
   • CIngest IOCs from the commercial feed into the SIEM for correlation with internal logs, and use the tactical reports to enrich alert context and prioritize alerts associated with active campaigns.
   • DStore all threat intelligence in a separate spreadsheet for analysts to review during weekly meetings, but do not integrate it into the SIEM or alerting workflow.
   Reveal Solution Discussion Select an answer first