Security Operations and Monitoring CISA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst notices a sudden spike in outbound network traffic from a single server, and the server is sending data to an external IP address that is not on any approved list. The server's CPU usage is also high. Which type of attack is most likely occurring?

   • ADenial of service (DoS) attack
   • BMan-in-the-middle (MITM) attack
   • CMalware infection with command-and-control (C2) communication
   • DSocial engineering attack
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of a vulnerability scanner?

   • ATo monitor network traffic in real time for malicious activity
   • BTo automatically identify known vulnerabilities in systems and applications
   • CTo actively exploit vulnerabilities in a system to demonstrate impact
   • DTo provide a real-time analysis of security alerts from various sources
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team wants to test the effectiveness of their security monitoring and incident response processes. They have a limited budget and cannot afford a full red team exercise. Which approach provides the most value for testing detection and response?

   • ADeploy a vulnerability scanner and review findings
   • BConduct a purple team exercise
   • CRun a tabletop exercise with the SOC team
   • DReview SIEM alerts from the past month
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization wants to ensure that its new web application is secure before going live. They have already run a vulnerability scanner and fixed all identified issues. What is the NEXT best step to identify logic flaws and business logic errors that scanners may miss?

   • AIncrease the frequency of vulnerability scans
   • BReview firewall rules
   • CPerform a manual penetration test
   • DDeploy an intrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a key purpose of log analysis in security monitoring?

   • ATo encrypt sensitive data at rest
   • BTo automatically block malicious IP addresses
   • CTo provide a backup of critical databases
   • DTo identify patterns of suspicious activity and support incident investigation
   Reveal Solution Discussion Select an answer first