Identify High Value / High Signal / High Noise Data Sources (e.g. Windows Process vs EDR Process Flow, or network/VPC Flow vs Packet Capture) and How They Support Security Operations Use Cases. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network security team is investigating a potential command-and-control (C2) communication. They need to determine if the traffic is malicious by examining the content of the packets, including payload data. Which data source would provide the necessary detail for this investigation?

   • AProxy logs
   • BFull packet capture (PCAP)
   • CNetFlow logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security architect is designing a monitoring solution for a hybrid cloud environment. The team needs to detect both external attacks and internal lateral movement. They have a limited budget and cannot afford full packet capture for all traffic. Which data source combination would provide the best coverage within budget?

   • AWindows event logs for all endpoints
   • BDNS logs for all traffic
   • CVPC flow logs for cloud traffic and NetFlow for on-premises traffic
   • DFull packet capture for cloud traffic only
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) is investigating a suspected privilege escalation attack. The team needs to understand the full sequence of process creation, including parent-child relationships, command-line arguments, and any file or registry modifications made by the malicious process. Currently, they have Windows Security Event logs (Event ID 4688) that capture process creation with command lines. Which additional data source would provide the most value for this investigation?

   • ANetwork flow logs
   • BEDR process flow data
   • CWindows Defender antivirus logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A cloud security team needs to monitor traffic within their VPC for potential lateral movement. They want to detect unusual communication patterns between instances without incurring the high storage cost of full packet capture. Which data source would best meet this requirement?

   • AVPC flow logs
   • BLoad balancer logs
   • CFull packet capture (PCAP)
   • DDNS logs
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does a high signal data source support security operations?

   • ABy requiring more storage capacity due to its large data volume.
   • BBy automatically blocking all malicious activity without human intervention.
   • CBy providing analysts with relevant and actionable information, reducing time spent on false leads.
   • DBy eliminating the need for any other data sources in the environment.
   Reveal Solution Discussion Select an answer first