Manage Security Operations CCSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is configuring monitoring for their cloud environment. They want to detect suspicious network traffic patterns that may indicate a new type of attack. Which security control would be MOST effective for this purpose?

   • AAn AI-based security system that uses machine learning to identify anomalous behavior.
   • BA honeypot that attracts attackers and logs their activities.
   • CAn intrusion detection system (IDS) that analyzes network traffic for known attack signatures.
   • DA network security group (NSG) that filters traffic based on allow/deny rules.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is designing a SOC for a hybrid cloud environment. The SOC will be responsible for monitoring both on-premises and cloud resources. The team is considering whether to use a single SIEM platform or separate SIEMs for each environment. Which factor is MOST important when making this decision?

   • AThe preference of the security team for different SIEM vendors.
   • BThe cost of licensing separate SIEM platforms for each environment.
   • CThe ability to correlate events across both environments to detect multi-stage attacks.
   • DThe need to comply with data residency requirements for logs.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a typical function performed by a Security Operations Center (SOC)?

   • ATiered analysis and escalation of security alerts
   • BDeveloping marketing strategies for cloud services
   • CManaging the organization's financial budget
   • DWriting application code for new features
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of monitoring security controls such as firewalls and intrusion detection systems (IDS)?

   • ATo detect and respond to potential security threats
   • BTo reduce the number of security controls needed
   • CTo ensure they are configured to block all traffic
   • DTo replace the need for incident response procedures
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is monitoring a cloud environment and notices that a network security group (NSG) rule is too permissive, allowing traffic from any source to a management port. The team wants to detect if this rule has been exploited. Which monitoring approach would be MOST effective?

   • AReview the NSG configuration periodically to ensure it is correct.
   • BUse a vulnerability scanner to check for open ports.
   • CEnable flow logs for the NSG and analyze them for unusual traffic patterns.
   • DDeploy a honeypot on the management port to attract attackers.
   Reveal Solution Discussion Select an answer first