Manage Security Operations CCSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a limited security budget and needs to conduct a vulnerability assessment. The team is considering using an external vendor to perform the assessment. Which factor is MOST important when selecting a vendor?

   • AThe vendor's ability to remediate the vulnerabilities found.
   • BThe vendor's cost compared to other vendors.
   • CThe vendor's experience with the company's specific technology stack.
   • DThe vendor's ability to provide a detailed report of findings.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing logs from multiple sources to investigate a potential data exfiltration. The analyst has access to firewall logs, IDS alerts, and authentication logs. Which approach would BEST help the analyst identify the sequence of events and the scope of the incident?

   • AReview authentication logs to see which accounts were compromised.
   • BSearch for the largest data transfers in the firewall logs to identify the exfiltration.
   • CCorrelate the logs by timestamp and user account to reconstruct the attack timeline.
   • DFocus only on the IDS alerts because they provide the most detailed attack information.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team has completed a vulnerability assessment and identified several vulnerabilities. The team needs to prioritize which vulnerabilities to remediate first. Which factor should be given the HIGHEST priority?

   • AThe ease of exploitation and the potential impact on critical assets.
   • BThe number of systems affected by the vulnerability.
   • CThe age of the vulnerability and how long it has been known.
   • DThe cost of remediation and the availability of patches.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's SIEM is generating a high volume of alerts, many of which are false positives. The security team wants to improve the accuracy of the alerts. Which action would be MOST effective?

   • AIncrease the number of log sources feeding into the SIEM.
   • BDisable the SIEM alerts and rely on manual log review.
   • CAdd more threat intelligence feeds to the SIEM.
   • DTune the correlation rules and adjust thresholds to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which phase of the incident response process involves actions to limit the scope of an incident?

   • AEradication
   • BRecovery
   • CContainment
   • DDetection
   Reveal Solution Discussion Select an answer first