7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technology is specifically designed to detect and prevent unauthorized transmission of sensitive data outside an organization?

   • AIntrusion Detection System (IDS)
   • BData Loss Prevention (DLP)
   • CNetFlow analysis
   • DFirewall
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company has deployed a SIEM and is experiencing a high volume of alerts from a rule that detects multiple failed logins followed by a successful login. The security team has confirmed that many employees frequently mistype their passwords and then successfully log in on the next attempt. The team wants to reduce the alert volume while still detecting actual brute-force attacks. What is the best approach?

   • AIncrease the threshold for the number of failed logins required to trigger the alert.
   • BDisable the rule entirely because the alerts are all false positives.
   • CAdd an exception list for all employees who have a history of mistyping passwords.
   • DChange the rule to alert only on failed logins without the successful login component.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services firm has deployed a network-based intrusion detection system (IDS) in monitor mode at the internet perimeter. The security team is receiving thousands of alerts daily, most of which are triggered by legitimate encrypted web traffic that matches signature patterns. The team wants to reduce noise while maintaining visibility into actual attack attempts. What should the security architect recommend?

   • ADisable the IDS signatures that are triggering on encrypted traffic and rely solely on the firewall logs for perimeter monitoring.
   • BTune the IDS signatures to reduce false positives and integrate the IDS alerts with the SIEM for correlation with other security events.
   • CSwitch the IDS to inline mode and configure it to block all traffic that matches the signature patterns.
   • DReplace the network-based IDS with a host-based intrusion detection system on every server to eliminate the encrypted traffic issue.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is an important consideration when deploying UEBA in an organization?

   • AUEBA must be trained with historical data to establish baselines
   • BUEBA can replace all other security monitoring tools
   • CUEBA requires no baseline data to function
   • DUEBA should be deployed without integration with other security tools
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of establishing a log retention policy?

   • ATo ensure logs are available for incident investigation and compliance
   • BTo prevent logs from being deleted by attackers
   • CTo reduce the cost of log storage
   • DTo make logs easier to analyze
   Reveal Solution Discussion Select an answer first