Identify Organizational Coverage for Prevention, Detection, Response and Recovery Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which finding would be classified as a detection coverage gap?

   • ANo monitoring or alerting on endpoints for suspicious process execution
   • BNo incident response playbook for ransomware scenarios
   • CNo firewall rules to block inbound traffic from untrusted networks
   • DNo backup verification process for critical databases
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A logistics company's business continuity plan relies on restoring its transportation management system (TMS) from backups. During a disaster recovery test, the team found that the TMS backups were corrupted and the restoration failed. The company wants to ensure that the TMS can be recovered even if the primary backup is unusable. Which action would most directly improve recovery coverage?

   • AMove the TMS to a cloud-based SaaS solution.
   • BEnable encryption on the TMS backups.
   • CIncrease the frequency of TMS backups to every four hours.
   • DImplement a secondary backup location with independent copies and regularly test restoration from that location.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which activity is primarily associated with detection coverage?

   • ARestoring a database from a backup after a data corruption event
   • BConfiguring a SIEM to generate alerts when a user account is locked out multiple times
   • CExecuting an incident response playbook to contain a malware outbreak
   • DApplying a security patch to a known vulnerability in a web server
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is primarily associated with response coverage?

   • AExecuting a playbook that isolates an infected endpoint from the network
   • BRestoring a server from a backup after a ransomware attack
   • CDeploying a web application firewall to block SQL injection attempts
   • DConfiguring a SIEM to alert on unusual outbound traffic
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A government agency has strong prevention controls (e.g., application allowlisting, network segmentation) and robust detection (e.g., SIEM, EDR). However, a recent penetration test revealed that the incident response team lacks a clear procedure for containing a compromised domain controller, and the recovery plan does not include a tested method for rebuilding the domain from scratch. Which gap is most critical to address first?

   • ADeploy additional network intrusion detection system (NIDS) sensors to improve detection of domain controller attacks.
   • BImplement stricter firewall rules to limit access to the domain controller.
   • CDevelop and test a domain controller recovery procedure, including a full forest recovery drill.
   • DIncrease the frequency of backups for the domain controller.
   Reveal Solution Discussion Select an answer first