Identify Organizational Coverage for Prevention, Detection, Response and Recovery Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A healthcare organization has monitoring in place for its email gateway, endpoint devices, and cloud workloads, but it lacks visibility into its on-premises legacy database servers. The security team is assessing detection coverage and wants to ensure that suspicious queries and unauthorized access attempts against these databases are identified. Which action would most effectively improve detection coverage for this environment?

   • ADeploy a database activity monitoring (DAM) solution that captures SQL queries and access logs from the legacy database servers.
   • BSchedule weekly manual reviews of database server logs by the security team.
   • CConfigure the network firewall to log all traffic to and from the database servers.
   • DAdd the database servers to the existing endpoint detection and response (EDR) console.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital's incident response plan includes a detailed playbook for ransomware, but during a real attack, the IT team discovered that the playbook did not specify how to prioritize the restoration of critical patient care systems over administrative systems. The result was a delayed recovery of life-sustaining equipment. Which improvement would best address this response and recovery gap?

   • ADeploy additional endpoint detection and response (EDR) tools on critical systems.
   • BTrain the IT team on ransomware response procedures.
   • CIncrease the frequency of backups for all systems to every hour.
   • DUpdate the playbook to include a system criticality matrix and a clear restoration order based on patient safety impact.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which element is most directly part of response coverage?

   • AA network intrusion detection system that generates alerts on suspicious traffic
   • BA backup solution that stores encrypted copies of critical data
   • CA documented incident response plan with defined roles and communication steps
   • DA firewall rule that blocks traffic from known malicious IP addresses
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A hospital's backup strategy includes nightly full backups to a local NAS and weekly off-site backups to a cloud provider. During a ransomware attack, the hospital discovered that the local NAS was encrypted and the cloud backups were not accessible because the cloud account credentials were also compromised. The hospital wants to ensure that backups remain recoverable even if both primary and secondary backup locations are compromised. Which action would best address this recovery gap?

   • AMove all backups to a different cloud provider.
   • BImplement immutable backups in the cloud with multi-factor authentication (MFA) and separate credentials for backup access.
   • CIncrease the frequency of local backups to every hour.
   • DStore backups on tape and keep them in a secure off-site location.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A manufacturing company has incident response playbooks for malware outbreaks and phishing campaigns, but during a recent ransomware simulation, the response team struggled to coordinate containment actions across IT and OT environments. The team realized that the playbook did not specify who has authority to disconnect OT systems from the network. Which improvement would most directly address this response coverage gap?

   • ACreate a new playbook for data exfiltration incidents.
   • BUpdate the ransomware playbook to include a clear decision tree and pre-authorized roles for isolating OT segments.
   • CConduct a tabletop exercise focused on phishing response procedures.
   • DDeploy additional endpoint detection and response (EDR) agents on OT workstations.
   Reveal Solution Discussion Select an answer first