7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of threat intelligence feed is typically free and publicly available, such as those provided by government agencies or community groups?

   • AInternal feed
   • BOpen-source feed
   • CCommercial feed
   • DProprietary feed
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the goal of tuning security alerts to reduce false positives?

   • ATo make alerts more general to cover all possible threats
   • BTo ensure that alerts are accurate and actionable
   • CTo eliminate the need for security analysts
   • DTo increase the number of alerts generated
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When analyzing logs, what is the primary purpose of correlating events from multiple sources?

   • ATo identify a sequence of events that indicates an attack
   • BTo reduce the volume of logs stored
   • CTo assign severity levels to individual logs
   • DTo delete duplicate log entries
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A defense contractor suspects that an employee is exfiltrating sensitive design documents by uploading them to a personal cloud storage account. The company has a data loss prevention (DLP) system that monitors outbound web traffic. What additional monitoring technique would best help confirm the exfiltration and identify the data involved?

   • ADeploy a network-based IDS to inspect the traffic for known malware signatures.
   • BReview the DLP logs for policy violations that match the document classification tags.
   • CIncrease the logging level on the employee's workstation to capture all file access events.
   • DEnable netflow analysis on the perimeter firewall to identify the volume of traffic to the cloud storage provider.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial institution is required by regulation to retain audit logs for seven years. The security team is concerned about the cost of storing this data and the risk of tampering. What is the most appropriate strategy for log management that balances compliance, cost, and security?

   • AStore all logs in their original format on low-cost archival storage with write-once, read-many (WORM) protection.
   • BDelete logs older than one year to reduce storage costs.
   • CStore logs in a SIEM database for seven years and rely on the SIEM's access controls.
   • DCompress the logs and store them on standard network storage without additional protection.
   Reveal Solution Discussion Select an answer first