Detect Threats Within Physical Infrastructure, Apps, Networks, Data, Users and Workloads CKS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company stores sensitive customer data in a database. They have implemented database audit logging, but they are concerned about attackers who may have legitimate credentials and are exfiltrating data slowly over time. Which detection method would best identify this slow exfiltration?

   • AImplement data masking for sensitive fields.
   • BIncrease the frequency of database backups to reduce data loss.
   • CUse anomaly detection on database query patterns to identify unusual access to sensitive data over time.
   • DRestrict access to the database to a smaller group of users.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which network activity is commonly monitored to detect port scanning?

   • AAn HTTP request to a web server
   • BA regular backup transfer to a storage server
   • CA large number of connection attempts to multiple ports on a single host
   • DA single DNS query to an internal server
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a common indicator of hardware tampering in a data center?

   • AAn unexpected open server chassis or broken security seal
   • BA sudden increase in network bandwidth usage
   • CA high number of failed login attempts on a web application
   • DAn unusual pattern of outbound DNS queries
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common method to detect data exfiltration?

   • AReviewing user login times
   • BScanning for open ports on servers
   • CChecking for physical tampering of hard drives
   • DMonitoring outbound network traffic for large or unusual data transfers
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A system administrator notices that a user account has been granted administrative privileges and has been accessing sensitive files outside of normal business hours. The user is a contractor who was recently hired. Which detection method would best identify this as a potential insider threat?

   • AMonitor user activity logs for privilege escalation and unusual access patterns.
   • BDisable the user's account immediately to prevent further access.
   • CConduct a vulnerability scan on the user's workstation.
   • DReview the user's employment contract to confirm their job responsibilities.
   Reveal Solution Discussion Select an answer first