1.5 Implement Continuous Monitoring and Analytics of Zero Trust Environment NETWORK-SECURITY-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does continuous monitoring integrate with identity policies in a zero trust architecture?

   • ABy providing real-time visibility into user behavior to enforce adaptive access decisions
   • BBy storing user passwords in plaintext for faster access
   • CBy replacing the need for multi-factor authentication
   • DBy eliminating the need for user identity verification
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which technology is commonly used to aggregate and correlate security logs from multiple sources for monitoring?

   • ASIEM (Security Information and Event Management)
   • BFirewall
   • CVPN (Virtual Private Network)
   • DIDS (Intrusion Detection System)
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large enterprise has implemented a zero trust architecture and uses a SIEM to monitor security events. The security team has configured alerts for multiple scenarios, but they are experiencing a high rate of false positives, leading to alert fatigue and missed critical alerts. The team wants to improve the accuracy of their alerts without reducing the coverage of real threats. Which approach is most effective?

   • AImplement user and entity behavior analytics (UEBA) to establish baselines and detect anomalies more accurately
   • BDisable alerts for less critical data sources to reduce noise
   • CIncrease the severity threshold for all alerts to reduce the number of notifications
   • DManually review all alerts and create exceptions for known false positives
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has deployed a zero trust architecture and uses a monitoring platform to detect threats. The security team wants to automatically respond to a detected threat by revoking a user's access to a critical application. However, the team is concerned about the risk of automatically revoking access for legitimate users due to false positives. Which approach balances automated response with minimizing disruption?

   • ARequire manual approval for all automated responses
   • BUse a risk-based scoring system that only triggers automated revocation for high-confidence threats
   • CAutomatically revoke access for all users in the same department as the detected threat
   • DAutomatically revoke access for all alerts that match a threat signature
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which technology extends beyond traditional endpoint detection to provide broader visibility and response across networks, endpoints, and cloud?

   • ANAC (Network Access Control)
   • BXDR (Extended Detection and Response)
   • CWAF (Web Application Firewall)
   • DDLP (Data Loss Prevention)
   Reveal Solution Discussion Select an answer first