6.1 Explain Security Operations Functions (e.g., Identify / Detect, Investigate, Mitigate, Improve) CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main objective of the Mitigate function in security operations?

   • ATo document lessons learned for future improvements.
   • BTo detect anomalies and potential incidents.
   • CTo contain, eradicate, and recover from security threats.
   • DTo analyze the root cause of an incident.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team has confirmed that a worm is spreading across the network by exploiting a known vulnerability in a legacy application. The team has identified the infected systems. What is the most effective Mitigate action to stop the spread?

   • ADelete the worm files from the infected systems without patching the vulnerability.
   • BIncrease the firewall logging level to capture more information about the worm's activity.
   • CPower off the infected systems and wait for the worm to die out.
   • DIsolate the infected systems from the network and apply the vendor's security patch to all systems.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is a typical step in the Investigate function of security operations?

   • ACorrelating logs from multiple sources to determine the attack path.
   • BConducting a post-incident review meeting.
   • CDeploying patches to vulnerable systems.
   • DSetting up new monitoring alerts for future threats.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team has confirmed that a phishing email with a malicious attachment was opened by several employees. The malware is now executing on their workstations. What is the most immediate Mitigate action?

   • ADelete the phishing email from all employees' mailboxes.
   • BRun a full antivirus scan on the affected workstations.
   • CNotify the employees to be cautious when opening emails in the future.
   • DDisconnect the affected workstations from the network to contain the malware.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a data breach where sensitive customer data was exfiltrated. The analyst has identified the entry point and the data that was taken. What is the next step in the Investigate function to fully understand the incident?

   • ADetermine the full scope of the breach by identifying all systems and data the attacker accessed.
   • BPatch the vulnerability that allowed the attacker to enter the network.
   • CRestore the exfiltrated data from backups to ensure it is not lost.
   • DNotify the affected customers about the breach immediately.
   Reveal Solution Discussion Select an answer first