Identify Data Sources Critical to Cybersecurity Operations, Such as Event Sources, Identity Directories, Asset Management Systems, and Vulnerability - Assessments. This Can Include Non-Security Data Sources, Eg. Observability Tools. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A security analyst is investigating a potential data breach that may have involved an attacker using a legitimate user's credentials. The analyst has access to firewall logs, Active Directory logs, and APM traces. Which data source would be most valuable to determine if the attacker accessed sensitive application data?

   • AAPM traces
   • BFirewall logs
   • CVulnerability scanner reports
   • DActive Directory logs
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is planning to implement a vulnerability management program. They have a limited budget and need to choose between investing in a vulnerability scanner or an asset management system. Which approach would provide the most value for security operations?

   • AInvest only in a vulnerability scanner
   • BInvest in neither and rely on manual processes
   • CInvest only in an asset management system
   • DInvest in both, as they complement each other
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A security team is planning a vulnerability management program. They have limited resources and need to prioritize remediation based on the risk to critical business systems. Which data source combination would provide the most effective prioritization?

   • AVulnerability scanner and firewall logs
   • BFirewall logs and identity directory
   • CAsset management system and identity directory
   • DVulnerability scanner and asset management system
   Reveal Solution Discussion Select an answer first