7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is investigating a potential data breach. The analyst has access to the SIEM, which aggregates logs from the firewall, Active Directory, and the web proxy. Which of the following actions would best help the analyst correlate events across these sources to understand the attack timeline?

   • AExport the logs from each source to a spreadsheet and manually compare them.
   • BFocus only on the firewall logs because they show all network traffic.
   • CUse the SIEM's correlation capabilities to query events across all sources for the affected user account and time period.
   • DSearch each log source separately for events related to the affected user account.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which type of threat is UEBA particularly effective at identifying?

   • ASQL injection attacks
   • BDistributed denial-of-service (DDoS) attacks
   • CMalware infections
   • DInsider threats
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement accurately describes a key difference between an intrusion detection system (IDS) and a firewall?

   • AA firewall is a passive monitoring device, while an IDS actively controls traffic flow.
   • BAn IDS monitors network traffic and alerts on suspicious activity, while a firewall enforces rules to allow or block traffic.
   • CAn IDS is designed to block malicious traffic, while a firewall only monitors and logs traffic.
   • DBoth IDS and firewall operate at the application layer only, but they use different detection methods.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which detection method used by an IDPS relies on a database of known attack patterns?

   • AAnomaly-based detection
   • BBehavioral analysis
   • CHeuristic analysis
   • DSignature-based detection
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has a network-based intrusion prevention system (IPS) deployed inline at the internet perimeter. The security team is concerned that the IPS might be blocking legitimate traffic due to false positives. What is the most appropriate way to address this concern while maintaining security?

   • ASwitch the IPS to monitor mode and rely on the firewall to block malicious traffic.
   • BDisable the IPS signatures that are causing the false positives.
   • CIncrease the sensitivity of the IPS to catch more potential threats.
   • DReview the IPS logs to identify the false positives and create exceptions for legitimate traffic.
   Reveal Solution Discussion Select an answer first