Identify Organizational Coverage for Prevention, Detection, Response and Recovery Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A law firm uses a cloud-based document management system (DMS) and is concerned about the risk of data exfiltration via compromised user accounts. The firm wants to prevent unauthorized downloads of sensitive client documents. Which control would most directly address this prevention gap?

   • ADeploy a web application firewall (WAF) in front of the DMS.
   • BImplement data loss prevention (DLP) policies that block or restrict downloads of sensitive documents based on classification.
   • CIncrease the password complexity requirements for user accounts.
   • DEnable audit logging for all document access and downloads.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A utility company has monitoring for its corporate IT network but lacks visibility into its operational technology (OT) environment, which uses legacy protocols like Modbus. The security team wants to detect anomalies in OT network traffic that could indicate a cyber-physical attack. Which addition would most directly improve detection coverage for the OT environment?

   • ADeploy an OT-specific network monitoring solution that can parse and analyze industrial protocols.
   • BInstall standard endpoint detection and response (EDR) agents on OT workstations.
   • CAdd a firewall rule to block all Modbus traffic.
   • DIncrease the log retention for IT firewall logs.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which component is most directly part of recovery coverage?

   • AAn incident response team that performs forensic analysis after a breach
   • BA business continuity plan that defines recovery time objectives for critical systems
   • CA security operations center (SOC) that monitors alerts 24/7
   • DA network access control (NAC) system that enforces endpoint compliance
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services firm has deployed a next-generation firewall (NGFW) at the internet perimeter, endpoint detection and response (EDR) on all laptops, and a web application firewall (WAF) in front of its customer portal. The security team is mapping coverage against the MITRE ATT&CK framework and notices that the 'Initial Access' technique T1190 (Exploit Public-Facing Application) is well covered, but the 'Lateral Movement' technique T1021 (Remote Services) is not explicitly addressed by any control. Which additional control would most directly close this prevention gap?

   • ADeploy host-based firewall rules on servers to restrict inbound RDP and SMB traffic to only authorized administrative hosts.
   • BImplement a SIEM alert for unusual RDP login patterns from internal hosts.
   • CEnable verbose logging on the NGFW to capture all inbound and outbound connection attempts.
   • DAdd a rule to the WAF to block SQL injection attempts against the customer portal.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A telecommunications company has incident response playbooks for network outages and malware infections, but during a recent data breach, the response team was unsure how to coordinate with legal, PR, and law enforcement. Which improvement would most directly address this response coverage gap?

   • ADeploy additional endpoint detection and response (EDR) tools on critical servers.
   • BConduct a tabletop exercise focused on malware response procedures.
   • CIncrease the frequency of data backups.
   • DDevelop a communication and stakeholder coordination playbook that defines roles, escalation paths, and legal notification requirements.
   Reveal Solution Discussion Select an answer first