Identify Organizational Coverage for Prevention, Detection, Response and Recovery Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which control is most directly aligned with prevention coverage for web application threats?

   • ABackup job that captures the application database every hour
   • BIncident response playbook that outlines steps to contain a web breach
   • CWeb application firewall (WAF) rules that block SQL injection payloads
   • DSecurity information and event management (SIEM) correlation rules that flag anomalous requests
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A university has deployed a SIEM that collects logs from its network devices, servers, and endpoints. However, the security team is concerned about blind spots in detection coverage for user behavior anomalies, such as compromised accounts performing unusual data access. Which addition would most directly improve detection coverage for this specific threat?

   • ADeploy additional network intrusion detection system (NIDS) sensors at the perimeter.
   • BAdd more correlation rules to the SIEM for known attack patterns.
   • CIncrease the log retention period for all sources.
   • DImplement user and entity behavior analytics (UEBA) to baseline normal user activity and flag anomalies.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which activity is primarily associated with recovery coverage?

   • ADeploying an intrusion prevention system to block exploit attempts
   • BConfiguring a SIEM to alert on anomalous login behavior
   • CRestoring a critical application from a verified backup after a system failure
   • DExecuting an incident response playbook to contain a malware outbreak
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A software development company uses a shared Kubernetes cluster for its microservices. The security team wants to prevent an attacker who compromises a single container from moving laterally to other containers or the host. Which control would most directly address this prevention gap?

   • AImplement network policies that restrict pod-to-pod communication to only required services.
   • BDeploy a web application firewall (WAF) in front of the ingress controller.
   • CEnable audit logging on the Kubernetes API server.
   • DUse a container registry with vulnerability scanning.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise has a comprehensive security program that includes prevention (EDR, NGFW), detection (SIEM, UEBA), response (playbooks, SOAR), and recovery (backups, DR site). However, a recent risk assessment identified that the company's third-party SaaS applications (e.g., email, CRM) are not covered by any of these capabilities. Which action would best address this coverage gap?

   • AExtend the security program to include SaaS applications by enabling provider-native security features, integrating logs into the SIEM, and adding SaaS-specific playbooks and backup solutions.
   • BConduct a tabletop exercise for a phishing incident.
   • CIncrease the frequency of backups for on-premises systems.
   • DDeploy a web application firewall (WAF) in front of the SaaS applications.
   Reveal Solution Discussion Select an answer first