3.1 Define Strategy Based on Data Sources, Business Alignment, Organization Strategy, and Best Practice SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which data source would be most relevant for a detection use case aimed at identifying malware infections on endpoints?

   • AHR onboarding documents
   • BFinancial transaction records
   • CPhysical access logs
   • DEndpoint telemetry
   Reveal Solution Discussion Select an answer first
2. 27application · easy

   A security operations team spends significant time manually quarantining malicious files identified by EDR alerts. The team wants to automate this task. Which definition best describes this automation use case?

   • AA strategy to hire more analysts to handle the alert volume.
   • BA policy that requires analysts to manually review all EDR alerts before taking action.
   • CA tool that generates a weekly report of all detected malware.
   • DA process that automatically isolates an endpoint when a high-confidence malicious file is detected.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How do automation use cases support the organization's overall security operations strategy?

   • ABy increasing the number of manual tasks
   • BBy improving efficiency and consistency of security operations
   • CBy bypassing security policies
   • DBy eliminating the need for security monitoring
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a best practice for developing detection use cases?

   • AMaking the use case as complex as possible
   • BIncluding as many threats as possible in a single use case
   • CFocusing on high-impact threats
   • DAvoiding any documentation of the use case
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team has developed a detection use case for 'lateral movement using PsExec.' The use case triggers on any execution of PsExec on any workstation or server. During a pilot, the use case generated 500 alerts in one week, of which only 5 were confirmed malicious. The team is considering how to improve the use case. Which improvement best applies the best practice of ensuring clarity and testability?

   • ARemoving the use case entirely, as it is generating too many false positives.
   • BAdding a condition to trigger only when PsExec is executed from a non-admin account.
   • CRequiring the use case to correlate PsExec execution with other suspicious activities, such as new service creation or unusual network connections.
   • DIncreasing the alert threshold to trigger only when PsExec is executed more than 10 times in a day.
   Reveal Solution Discussion Select an answer first