6.1 Explain Security Operations Functions (e.g., Identify / Detect, Investigate, Mitigate, Improve) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   After a major security incident, the incident response team has completed the investigation and mitigation. During the post-incident review, the team identifies that the attack exploited a vulnerability in a third-party plugin that was not patched. The team also notes that the detection system did not alert on the attack because the signature was outdated. What is the most comprehensive Improve action?

   • AOnly update the detection signatures to ensure future attacks are detected.
   • BUpdate the detection signatures and implement a patch management process for third-party plugins.
   • COnly implement a patch management process for third-party plugins.
   • DConduct a vulnerability scan to identify other unpatched plugins.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a data breach where customer data was accessed by an unauthorized party. The analyst has identified the vulnerability that was exploited and the data that was accessed. What is the most important next step in the Investigate function to support the Improve function?

   • ADetermine the root cause of the vulnerability and identify all systems that share the same weakness.
   • BNotify the affected customers about the breach immediately.
   • CRestore the accessed data from backups to ensure data availability.
   • DPatch the vulnerability on the affected system to prevent further exploitation.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst notices a sudden spike in outbound traffic from a single workstation at 2:00 AM. The traffic is encrypted and directed to a known file-sharing domain. The analyst must determine whether this is a security incident before escalating. Which action best aligns with the Identify/Detect function?

   • AImmediately block the workstation's IP address at the firewall to stop the traffic.
   • BDisconnect the workstation from the network and reimage it from a known-good backup.
   • CCompare the traffic pattern against established baselines and check the workstation for signs of malware.
   • DDocument the traffic spike in the shift log and continue monitoring for additional occurrences.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC analyst is reviewing alerts and sees a single failed login attempt for a user account, followed by a successful login from a different geographic location within 5 minutes. The user is currently on vacation. The analyst must decide whether to escalate this as a potential incident. Which consideration is most important in the Identify/Detect phase?

   • AThe failed login attempt is the most critical indicator and should be the primary reason for escalation.
   • BThe geographic location of the successful login is inconsistent with the user's known travel patterns.
   • CThe analyst should immediately block the user's account to prevent further access, regardless of the investigation.
   • DThe user is on vacation, so any login activity is suspicious and should be treated as a confirmed incident.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the primary purpose of the Identify/Detect function in security operations?

   • ATo document lessons learned and update security policies after an incident.
   • BTo recognize potential security incidents and anomalies by monitoring and analyzing activity.
   • CTo contain and eradicate threats that have already been confirmed.
   • DTo analyze the scope and impact of a confirmed incident in detail.
   Reveal Solution Discussion Select an answer first