Harden the Storage System CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of audit logging on a storage system?

   • ATo reduce the amount of data stored by compressing files
   • BTo improve storage performance by caching frequently accessed data
   • CTo record security-relevant events for detection and investigation
   • DTo automate the process of creating backups
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is investigating a potential security incident on a storage system. The analyst needs to determine which user account was used to delete a critical volume. The storage system has audit logging enabled. What should the analyst do?

   • AInterview the administrators who had access to the storage system at the time of the deletion.
   • BCheck the system's event logs for any errors that occurred at the time of the deletion.
   • CReview the audit logs for the volume deletion event, which should include the username, timestamp, and source IP address.
   • DReview the access control lists (ACLs) on the volume to see who had permission to delete it.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A storage administrator is managing a storage system that is critical to the company's operations. The vendor has released a firmware update that fixes a critical security vulnerability, but the update requires a reboot of the storage system. The administrator wants to apply the update with minimal impact on availability. What should the administrator do?

   • ASchedule the firmware update during a maintenance window and coordinate with the application teams to ensure that data is replicated and failover is tested.
   • BApply the firmware update to a non-production system and then apply it to the production system without testing failover.
   • CApply the firmware update immediately without notifying the application teams.
   • DWait for the next scheduled maintenance window, even if it is several months away.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A storage administrator is hardening a storage system that is accessible over a corporate network. The administrator wants to ensure that storage traffic is protected from eavesdropping and that only authorized hosts can reach the storage ports. Which two actions should the administrator take?

   • AEnable IPsec or MACsec for storage traffic and configure a firewall to allow only specific host IP addresses.
   • BSegment the storage network into a separate VLAN and enable audit logging on the storage system.
   • CEnable encryption at rest and configure role-based access control (RBAC) for storage volumes.
   • DDisable all unused storage protocols and enable strong password authentication for all users.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is investigating a potential data breach on a storage system. The team suspects that an attacker may have used a compromised administrator account to access sensitive data. The storage system has audit logging enabled, but the logs are stored locally on the storage system. The team wants to ensure that the logs are preserved for forensic analysis. What should the team do?

   • ARestore the storage system from a backup and then review the audit logs.
   • BDisable the compromised account and continue to rely on the local audit logs.
   • CEnable additional audit logging and wait for the investigation to complete.
   • DImmediately copy the local audit logs to a remote, write-once, read-many (WORM) storage system.
   Reveal Solution Discussion Select an answer first