Identify Data Sources Critical to Cybersecurity Operations, Such as Event Sources, Identity Directories, Asset Management Systems, and Vulnerability - Assessments. This Can Include Non-Security Data Sources, Eg. Observability Tools. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is responding to a ransomware incident and needs to quickly identify all endpoints that are missing a critical security patch. They have access to vulnerability scanner reports and a CMDB. Which approach would be most efficient?

   • AUse only the vulnerability scanner reports to identify affected endpoints
   • BQuery firewall logs for endpoints that have not communicated recently
   • CUse only the CMDB to identify endpoints missing the patch
   • DCorrelate vulnerability scanner reports with the CMDB to identify affected endpoints
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What type of data do identity directories like Active Directory and LDAP provide that is essential for security investigations?

   • AVulnerability scan results
   • BApplication performance metrics
   • CAuthentication and authorization events
   • DNetwork packet captures
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center is overwhelmed with alerts and needs to reduce false positives. They want to enrich authentication events with additional context to determine if a login is legitimate. Which data source would provide the most useful enrichment?

   • AIdentity directory (Active Directory)
   • BVulnerability scanner data
   • CNetwork flow logs
   • DAsset inventory list
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of non-security data from observability tools that could help correlate with security events?

   • AFirewall allow/deny logs
   • BAntivirus detection alerts
   • CServer CPU and memory utilization metrics
   • DUser authentication success/failure events
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is investigating a potential insider threat where an employee may have accessed sensitive files outside of normal working hours. They have access to Active Directory logs, firewall logs, and a CMDB. Which data source would provide the most direct evidence of the employee's actions?

   • ACMDB
   • BFirewall logs
   • CActive Directory logs
   • DVulnerability scanner reports
   Reveal Solution Discussion Select an answer first