Develop Scalable Strategies for Agile and DevOps-driven Cybersecurity Defenses, Such as Detection as Code. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is starting to manage their detection rules in a version control system. They want to track who changed what, when, and why, and they want to enable multiple analysts to work on different detections simultaneously without conflicts. Which version control practice should they adopt?

   • AUse a distributed version control system like Git, with each analyst cloning the repository and working on separate branches.
   • BUse a shared document with a change log at the bottom.
   • CUse a centralized version control system with a single working copy shared by all analysts.
   • DUse a file server with versioned folders and a naming convention for each change.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of monitoring detection performance?

   • ATo reduce the number of detections needed
   • BTo ensure detections are running and producing expected results
   • CTo automatically fix all detection issues
   • DTo replace the need for threat intelligence
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of a peer review workflow for detection rules?

   • ATo ensure only senior staff can make changes
   • BTo replace automated testing
   • CTo catch errors and improve detection quality before deployment
   • DTo speed up the deployment process
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team has deployed a detection rule that is missing some true positives. They want to use operational feedback to improve the rule. Which action should they take?

   • AReview missed detections from incident reports and adjust the rule's logic to capture them.
   • BDisable the rule and rely on manual analysis.
   • CWait for the next threat intelligence update to see if the rule improves.
   • DIncrease the rule's threshold to reduce false negatives.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is adopting detection as code. They have a large number of existing detections that were created manually and are not in version control. They want to migrate them to a Git repository and establish a CI/CD pipeline. They also want to ensure that the migration does not disrupt current detection capabilities. What is the best approach?

   • AMigrate only new detections to Git and leave existing ones as they are.
   • BMigrate all detections to Git in a single large commit, then set up the CI/CD pipeline.
   • CMigrate detections in small batches, testing each batch in a staging environment before deploying to production.
   • DMigrate detections to Git but do not set up a CI/CD pipeline until all are migrated.
   Reveal Solution Discussion Select an answer first