Use Common Methodologies for Risk and Detection Prioritization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team has implemented a set of detection use cases based on an initial risk assessment. Six months later, the organization has adopted new cloud services and the threat landscape has shifted. What should the team do to ensure their detection priorities remain effective?

   • AReplace all existing detections with new ones based on the latest threat intelligence.
   • BOnly add new detections when a security incident occurs.
   • CKeep the detection use cases unchanged to maintain consistency.
   • DConduct a periodic review of the risk assessment and update detection use cases accordingly.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations team is deciding which detection use cases to implement. They have limited engineering resources and want to focus on detections that address the most relevant threats to their industry. They have access to threat intelligence indicating that ransomware operators are actively targeting their sector. Which detection use case should be prioritized?

   • ADetection of failed logon attempts, which is a common but noisy event.
   • BDetection of USB device insertion, which is a generic but low-impact event.
   • CDetection of DNS queries to known malware domains, which is a broad indicator.
   • DDetection of unusual PowerShell execution, a common technique used in ransomware attacks.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is reviewing a series of alerts and wants to understand the adversary's progression through the attack lifecycle. They have observed initial access via a phishing email, followed by command and control traffic. Using MITRE ATT&CK, which tactic should the analyst look for next to anticipate the adversary's likely next move?

   • AImpact
   • BResource Development
   • CLateral Movement
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has identified a risk of data exfiltration from its cloud storage. The risk is assessed as high likelihood and high impact. The company has a limited budget and must choose a risk treatment option. They are considering purchasing cyber insurance, implementing data loss prevention (DLP) controls, or accepting the risk. Which option is the most appropriate risk treatment?

   • AAvoid the risk by discontinuing the use of cloud storage.
   • BImplement DLP controls to mitigate the risk by reducing likelihood.
   • CAccept the risk because the budget is limited.
   • DPurchase cyber insurance to transfer the financial risk.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which asset classification label would be most appropriate for a database containing customer payment card information that is subject to regulatory requirements?

   • APublic
   • BInternal
   • CConfidential
   • DTop Secret
   Reveal Solution Discussion Select an answer first