Use Common Methodologies for Risk and Detection Prioritization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of continuous monitoring in risk management?

   • ATo replace the need for periodic risk assessments
   • BTo ensure that risk assessments are only performed annually
   • CTo provide ongoing visibility into the effectiveness of security controls and changes in risk
   • DTo automate all security decisions
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational corporation must comply with multiple regulatory frameworks and wants to adopt a single risk assessment framework that can integrate with existing compliance requirements while providing a structured approach. They are considering NIST RMF, ISO 27005, and FAIR. Which framework should they choose to best meet this need?

   • AFAIR, because it provides quantitative risk analysis.
   • BUse all three frameworks simultaneously to cover all bases.
   • CISO 27005, because it is internationally recognized and aligns with ISO 27001.
   • DNIST RMF, because it is widely adopted in the US and aligns with federal compliance.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the MITRE ATT&CK framework, what is a 'technique'?

   • AA vulnerability in a system
   • BA high-level goal that an adversary wants to achieve
   • CA specific method an adversary uses to achieve a tactical goal
   • DA software tool used by security analysts
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A healthcare organization is classifying its assets to support risk prioritization. They have an electronic health record (EHR) system, a building access control system, a public patient portal, and an internal wiki. Which asset should be assigned the highest criticality value?

   • AInternal wiki
   • BElectronic health record (EHR) system
   • CBuilding access control system
   • DPublic patient portal
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is reviewing a detection rule that triggers on a specific MITRE ATT&CK technique. The rule has a high false positive rate, causing alert fatigue. The analyst wants to improve the rule's precision without significantly reducing its ability to detect the technique. Which approach is most effective?

   • AAdd additional context, such as specific process paths or command-line arguments, to the rule.
   • BDisable the rule and rely on manual analysis.
   • CChange the rule to detect a different technique that has fewer false positives.
   • DIncrease the alert threshold to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first