Identify Data Sources Critical to Cybersecurity Operations, Such as Event Sources, Identity Directories, Asset Management Systems, and Vulnerability - Assessments. This Can Include Non-Security Data Sources, Eg. Observability Tools. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an investigation of a suspicious login, an analyst needs to determine if the user account is active, when the password was last changed, and which groups the user belongs to. Which data source should the analyst query?

   • AVulnerability scanner reports
   • BFirewall logs
   • CActive Directory
   • DAsset management CMDB
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which data source is most directly relevant for determining whether a specific system has known vulnerabilities that could be exploited?

   • AVulnerability assessment reports
   • BObservability metrics
   • CAsset management inventory
   • DIdentity directory logs
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why is it important to include identity directory logs in a security data strategy?

   • AThey provide evidence of who accessed what and when, which is essential for investigating unauthorized access.
   • BThey contain the actual content of network packets, which is needed for deep packet inspection.
   • CThey provide real-time alerts for malware infections on endpoints.
   • DThey list all known vulnerabilities in the environment, which helps prioritize patching.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which cybersecurity event source is specifically designed to detect and alert on suspicious activity occurring on individual hosts, such as unusual process execution or file modifications?

   • AEndpoint detection and response (EDR) agent
   • BDomain name system (DNS) server
   • CCloud access security broker (CASB)
   • DIntrusion prevention system (IPS)
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What type of information from an asset management system helps security analysts determine which devices are most critical to the business and should be prioritized during an incident?

   • ABusiness criticality and asset ownership
   • BVulnerability exploit code
   • CAuthentication logs
   • DNetwork traffic patterns
   Reveal Solution Discussion Select an answer first