Security Operations and Monitoring CISA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary function of a security information and event management (SIEM) system?

   • ATo scan systems for known vulnerabilities and misconfigurations
   • BTo provide a secure communication channel for remote access
   • CTo aggregate and analyze security logs and events from multiple sources to detect and respond to incidents
   • DTo block malicious network traffic in real time
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security operations center (SOC) is overwhelmed with alerts, many of which are false positives. The team wants to reduce alert noise while ensuring that genuine threats are not missed. Which approach is most effective?

   • AHire more analysts to review all alerts
   • BImplement alert correlation rules and tune detection logic
   • CDisable alerts for low-priority assets
   • DIncrease the threshold for all alerts to reduce volume
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to test its security controls without the knowledge of its security team to see if they detect and respond to a real attack. Which type of testing is this?

   • AVulnerability assessment
   • BRed team exercise
   • CTabletop exercise
   • DCompliance audit
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's website is experiencing slow response times, and the network team notices a large volume of incomplete TCP connections to the web server. Which type of attack is most likely occurring?

   • AMan-in-the-middle attack
   • BSQL injection
   • CPhishing attack
   • DSYN flood
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is planning to test the effectiveness of their incident response process by simulating a real attack. They want to use a method that is safe and does not disrupt production systems. Which approach is most appropriate?

   • AFull penetration test against production servers
   • BRun a denial-of-service attack against a test server
   • CDeploy a vulnerability scanner to production
   • DTabletop exercise with the incident response team
   Reveal Solution Discussion Select an answer first