7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary function of User and Entity Behavior Analytics (UEBA)?

   • ATo encrypt sensitive data at rest
   • BTo detect anomalies in user and entity behavior
   • CTo manage user access permissions
   • DTo block malicious IP addresses
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices that an intrusion prevention system (IPS) is not detecting a known attack pattern. Upon reviewing packet captures, the analyst sees the attack payload is split across multiple small TCP segments, each under the IPS's reassembly buffer size. What evasion technique is the attacker using, and what is the most effective mitigation?

   • AResource exhaustion evasion; the mitigation is to increase the IPS memory allocation for connection tracking.
   • BFragmentation evasion; the mitigation is to configure the IPS to perform full stream reassembly before signature matching.
   • CProtocol mutation evasion; the mitigation is to update the IPS signature database to the latest version.
   • DEncryption evasion; the mitigation is to deploy a TLS inspection proxy to decrypt traffic before the IPS.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center wants to improve its detection of emerging threats by incorporating threat intelligence feeds into its SIEM. The team is evaluating a free open-source feed of IP addresses known for malicious activity and a commercial feed that provides detailed indicators of compromise (IOCs) with context. What is the most important consideration when integrating these feeds?

   • ABoth feeds should be integrated and correlated with internal logs to identify relevant threats.
   • BThe commercial feed is more reliable, so the open-source feed should be ignored.
   • CThe feeds should be used to automatically block all IP addresses listed in them.
   • DThe open-source feed is free, so it should be used exclusively to reduce costs.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of continuous monitoring in an organization's security program?

   • ATo provide real-time visibility into security controls and threats
   • BTo replace periodic risk assessments
   • CTo automate all security decisions
   • DTo eliminate the need for incident response
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has implemented a data loss prevention (DLP) system that monitors outbound email and web traffic. The security team is concerned that an employee could exfiltrate data using an encrypted tunnel, such as SSH or TLS, which the DLP cannot inspect. What is the most effective additional control to detect this type of exfiltration?

   • ABlock all encrypted traffic to external destinations.
   • BDeploy a network-based IDS to inspect the encrypted traffic for known malware signatures.
   • CUse netflow analysis to identify unusual volumes of traffic to external destinations.
   • DIncrease the logging level on the employee's workstation to capture all file access events.
   Reveal Solution Discussion Select an answer first