Identify Organizational Coverage for Prevention, Detection, Response and Recovery Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A media company's web application allows users to upload files. The security team is concerned about the risk of malicious file uploads leading to code execution on the server. Which control would most directly prevent this attack vector?

   • AIncrease the upload size limit to accommodate larger legitimate files.
   • BImplement strict file type validation and store uploaded files in a separate domain with no execution permissions.
   • CEnable verbose logging of all file uploads and access attempts.
   • DDeploy a web application firewall (WAF) to filter upload requests.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A financial institution has a well-documented incident response plan, but during a live ransomware exercise, the response team discovered that the plan did not specify how to handle the legal and regulatory reporting requirements for a data breach. The team was unsure whether to notify regulators before or after containing the incident. Which improvement would best address this response coverage gap?

   • AConduct a tabletop exercise focused on malware containment procedures.
   • BIncrease the frequency of backups for customer data.
   • CIntegrate legal and regulatory reporting requirements into the incident response plan, including a timeline for notifications.
   • DDeploy additional endpoint detection and response (EDR) tools on critical servers.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational organization has strong prevention controls (EDR, NGFW, email filtering) and comprehensive detection (SIEM, UEBA) for its corporate network. However, a recent audit revealed that its subsidiary in a high-risk region has no local security team and relies on the parent company's SOC, which only monitors during business hours in the parent's time zone. The subsidiary operates 24/7. Which combination of actions would best close the most critical coverage gaps?

   • AEstablish a local incident response team at the subsidiary with 24/7 on-call rotation.
   • BImplement a VPN for subsidiary users to access the parent company's network resources.
   • CExtend SOC monitoring to 24/7 and implement automated alert triage for after-hours incidents.
   • DDeploy additional EDR agents on subsidiary endpoints and increase log retention.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which activity is primarily associated with prevention coverage in a security architecture?

   • AConducting tabletop exercises to validate the incident response plan
   • BDeploying endpoint detection and response agents that alert on suspicious process behavior
   • CRestoring systems from backups after a ransomware attack
   • DImplementing network segmentation and access control lists to limit lateral movement
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A bank's security operations center (SOC) relies on a SIEM that ingests logs from firewalls, servers, and endpoints. However, the SOC team is missing visibility into cloud infrastructure activity, such as changes to IAM policies or S3 bucket permissions. Which addition would most directly improve detection coverage for cloud-specific threats?

   • AIncrease the log retention period for existing on-premises logs.
   • BEnable cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Log) and ingest them into the SIEM.
   • CImplement a web application firewall (WAF) for cloud-hosted web applications.
   • DDeploy a network intrusion detection system (NIDS) in the cloud VPC.
   Reveal Solution Discussion Select an answer first