Perform Information Security Continuous Monitoring CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team receives a threat intelligence report describing a new malware family that uses a specific command-and-control domain and a unique TLS certificate fingerprint. The team wants to incorporate this into their SIEM to detect infections. Which type of threat intelligence is most appropriate for this purpose?

   • AStrategic intelligence summarizing geopolitical risks
   • BTactical intelligence describing attacker methodologies
   • CTechnical intelligence with indicators of compromise
   • DOperational intelligence detailing ongoing campaigns
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is investigating a potential data exfiltration. The SIEM shows a large outbound transfer from a server to an external IP. To understand the sequence of actions that led to the transfer, which type of observable data would be most helpful?

   • AMetrics showing CPU and memory usage
   • BTrace data showing the sequence of system calls and network connections
   • CConfiguration management database records
   • DThreat intelligence reports on similar attacks
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team wants to improve their monitoring by understanding the tactics, techniques, and procedures (TTPs) used by a specific threat actor group. Which type of threat intelligence would provide this information?

   • AOperational intelligence
   • BTechnical intelligence
   • CStrategic intelligence
   • DTactical intelligence
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which core function of a SIEM involves combining data from multiple sources to identify patterns that indicate a security threat?

   • ACorrelation
   • BAlerting
   • CReporting
   • DLog aggregation
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team's SIEM uses signature-based detection and generates many false positives for legitimate administrative activity. They are considering adding an anomaly-based detection system. The team is concerned about alert fatigue and wants to improve detection accuracy. What is the most effective strategy?

   • ADisable all alerting and review logs manually
   • BReplace signature-based detection with anomaly-based detection
   • CIncrease the sensitivity of signature-based detection
   • DUse both methods and correlate alerts to reduce false positives
   Reveal Solution Discussion Select an answer first