Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team uses a SIEM with a signature-based intrusion detection system. They receive a tactical intelligence report describing a new attack technique that exploits a specific application vulnerability. The report includes no IOCs. The team wants to detect this attack. What is the most effective approach?

   • AWait for the vendor to release a signature update
   • BDisable signature-based detection to avoid false positives
   • CDevelop a detection rule based on the described technique and monitor for related behavior
   • DSearch for the vulnerability in the organization's asset inventory
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which method is commonly used to collect observable data from a wide variety of sources, such as servers, network devices, and applications?

   • AAutomated agents or forwarders
   • BManual data entry by administrators
   • CPeriodic manual exports
   • DUsing a single vendor's proprietary format
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global company's continuous monitoring program collects logs from all regions into a central SIEM in the United States. A new privacy regulation in the European Union restricts the transfer of personal data outside the EU. The company must maintain monitoring capabilities. What is the most appropriate action?

   • ADeploy a separate SIEM in the EU and route EU logs to it
   • BAnonymize all EU logs before sending them to the US SIEM
   • CStop collecting logs from EU systems
   • DObtain consent from all EU users to transfer their data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of normalizing observable data from diverse sources?

   • ATo convert data into a common format for consistent analysis
   • BTo reduce the storage size of the data
   • CTo delete duplicate events
   • DTo encrypt the data in transit
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company wants to integrate cloud infrastructure logs, on-premises firewall logs, and custom application logs into a single SIEM for centralized monitoring. The logs use different formats and timestamp conventions. What is the first step the team should take to enable effective analysis?

   • AIncrease storage capacity to handle the additional logs
   • BCreate separate dashboards for each log source
   • CStore logs in their original format and search them individually
   • DDefine a common data schema and normalize all logs to it
   Reveal Solution Discussion Select an answer first