6.1 Explain Security Operations Functions (e.g., Identify / Detect, Investigate, Mitigate, Improve) CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) has confirmed that a phishing email led to a user's credentials being compromised. The analyst needs to understand the full scope of the incident. Which activity is most directly part of the Investigate function?

   • AResetting the compromised user's password and enforcing multi-factor authentication.
   • BSending a company-wide email warning users about the phishing campaign.
   • CReviewing authentication logs to identify which systems the attacker accessed with the stolen credentials.
   • DDeleting the phishing email from the user's mailbox to prevent further clicks.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which action is an example of the Mitigate function?

   • AUpdating the incident response plan based on findings.
   • BReviewing firewall logs to identify suspicious traffic.
   • CInterviewing employees to gather information about the incident.
   • DIsolating an infected host from the network.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst is monitoring a dashboard and sees an alert for a new user account being created on a domain controller. The analyst does not recognize the account name. What is the most appropriate action for the Identify/Detect function?

   • AInvestigate the alert by checking the account creation logs and the source of the request.
   • BDisable the new user account immediately to prevent potential unauthorized access.
   • CIgnore the alert because new user accounts are often created by administrators.
   • DReset the password for the new user account to ensure it is secure.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of the Improve function in security operations?

   • ATo use lessons learned from incidents to enhance security posture and processes.
   • BTo identify potential threats and anomalies in real time.
   • CTo contain and eradicate active threats.
   • DTo analyze the scope and impact of an incident.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A security analyst notices unusual outbound traffic from a workstation. Which security operations function is being performed when the analyst determines whether this activity indicates a security incident?

   • AMitigate
   • BImprove
   • CInvestigate
   • DIdentify/Detect
   Reveal Solution Discussion Select an answer first