3.1 Define Strategy Based on Data Sources, Business Alignment, Organization Strategy, and Best Practice SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why should automation use cases be aligned with business needs?

   • ATo ensure automation efforts deliver value such as reduced response times
   • BTo increase the complexity of security operations
   • CTo satisfy vendor requirements
   • DTo replace all security analysts
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is testability an important best practice for detection use cases?

   • AIt allows the use case to be validated against known threat scenarios
   • BIt eliminates the need for threat intelligence
   • CIt makes the use case easier to write
   • DIt reduces the need for security monitoring
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key objective that automation use cases should support in alignment with the organization's security strategy?

   • AReplacing the need for threat intelligence
   • BReducing the mean time to respond (MTTR)
   • CEliminating all security alerts
   • DIncreasing the number of false positives
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to align detection use cases with business priorities?

   • ATo reduce the number of security tools needed
   • BTo make detection use cases easier to implement
   • CTo satisfy regulatory requirements only
   • DTo ensure security monitoring supports organizational goals
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst proposes a detection use case for 'suspicious PowerShell activity.' The use case triggers on any PowerShell execution on any endpoint. The team has a high volume of legitimate PowerShell usage by IT administrators. Which modification best applies the best practice of focusing on high-impact threats while maintaining clarity?

   • AChange the use case to detect only PowerShell downloads from the internet.
   • BNarrow the use case to PowerShell execution combined with known malicious indicators or unusual parent processes.
   • CExclude all IT administrator endpoints from the use case.
   • DKeep the use case broad to ensure no malicious PowerShell activity is missed.
   Reveal Solution Discussion Select an answer first