Identify Data Sources Critical to Cybersecurity Operations, Such as Event Sources, Identity Directories, Asset Management Systems, and Vulnerability - Assessments. This Can Include Non-Security Data Sources, Eg. Observability Tools. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations team is deploying a new SIEM and must prioritize which event sources to ingest first. They have limited ingestion capacity and need to maximize visibility into network-based threats. Which data source should be prioritized?

   • AFirewall logs
   • BEmployee timesheet data
   • CPrinter supply levels
   • DMarketing campaign metrics
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is investigating a distributed denial-of-service (DDoS) attack that targeted a web application. The analyst has access to firewall logs, infrastructure monitoring metrics, and APM traces. Which data source would be most helpful to understand the impact on application performance?

   • AVulnerability scanner reports
   • BInfrastructure monitoring metrics
   • CAPM traces
   • DFirewall logs
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a potential account compromise and needs to see all successful and failed authentication attempts for a specific user across the environment. Which data source should be the primary source for this information?

   • AVulnerability scanner data
   • BIdentity directory (Active Directory) logs
   • CAsset inventory list
   • DFirewall logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations team is investigating a series of failed login attempts followed by a successful login from an unusual location. They want to determine if the successful login was legitimate. Which data source would provide the most useful context?

   • AFirewall logs
   • BAsset management CMDB
   • CVulnerability scanner data
   • DIdentity directory (Active Directory) logs
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of system is designed to maintain a centralized record of IT assets, their configurations, and relationships, often used to provide context for security incidents?

   • ASecurity information and event management (SIEM) system
   • BConfiguration management database (CMDB)
   • CPatch management tool
   • DIntrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first