2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   An organization wants to enrich security events with information about which users are managers and which are contractors. Which entity data source would provide this information?

   • AEndpoint detection and response (EDR) alerts
   • BIdentity provider (IdP) such as Okta or Azure AD
   • CDNS logs
   • DNetwork flow logs
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team receives threat intelligence from multiple sources, including open-source feeds, commercial vendors, and industry sharing groups. They notice that some IOCs are conflicting (e.g., one source labels an IP as malicious, another labels it as benign). What is the most effective way to handle this conflict?

   • ATrust the source with the highest reputation and ignore the conflicting data.
   • BDiscard the IOC entirely because of the conflict.
   • CAutomatically block the IOC to be safe, regardless of conflicting information.
   • DCorrelate the IOC with internal telemetry and other sources to determine its relevance and validity.
   Reveal Solution Discussion Select an answer first