Perform Technical Management ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is implementing a new security information and event management (SIEM) system. The team has defined a set of metrics to measure the system's effectiveness, including the number of alerts generated, the number of false positives, and the mean time to detect (MTTD) and respond (MTTR) to incidents. After several months, the team notices that the number of alerts is very high, but the number of true positives is low. The team is spending a significant amount of time investigating false positives. What is the most appropriate action for the security engineer to take?

   • AIncrease the number of alerts by adding more rules to the SIEM to ensure no potential threats are missed.
   • BStop using the SIEM and rely on manual analysis of logs.
   • CReduce the number of alerts by tuning the SIEM rules to reduce false positives, even if it means missing some true positives.
   • DAnalyze the false positives to identify patterns and adjust the SIEM rules to improve the signal-to-noise ratio.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is evaluating a new security automation tool that promises to reduce the time spent on routine security tasks. The security engineer is asked to assess the tool's efficiency. Which of the following is the most important factor to consider?

   • AThe tool's user interface and ease of use.
   • BThe tool's performance, such as the time it takes to complete a specific task compared to the manual process.
   • CThe tool's cost relative to the organization's budget.
   • DThe tool's ability to integrate with the organization's existing security infrastructure.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security engineer is reviewing the configuration management process for a new web application. The engineer discovers that the development team has been making direct changes to the production configuration without documenting them. What is the primary security risk of this practice?

   • AThe changes may not be included in the next backup, leading to data loss.
   • BThe changes may introduce vulnerabilities that are not reviewed or approved, compromising the system's security posture.
   • CThe changes will cause the system to become unstable and crash.
   • DThe changes will not be reflected in the system's performance monitoring data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team has implemented a new automated vulnerability scanning tool. The team wants to measure the tool's effectiveness. Which metric would be most useful for this purpose?

   • AThe time it takes for the tool to scan the entire network.
   • BThe percentage of known vulnerabilities in the environment that the tool correctly identifies.
   • CThe number of vulnerabilities the tool can detect.
   • DThe number of false positives generated by the tool.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which activity is a core part of configuration management?

   • APerforming daily backups of all system data
   • BDeveloping the system's disaster recovery plan
   • CControlling changes to system components through a formal change management process
   • DConducting penetration tests on the system
   Reveal Solution Discussion Select an answer first