Cyber Kill Chain PBQ

Cyber Kill Chain PBQ Question 1 Why is it important to have synchronized time across all systems in a network for effective log ingestion? To ensure logs are collected in real-time To prevent unauthorized access to logs To correlate events accurately across different systems To reduce the size of log files Correct Synchronizing time across all systems ensures that events correlate accurately. 1 / 1 point 2. Question 2 You need to identify a potential security incident. To do so, you correlate events from multiple sources. Which SIEM feature would you use? Event correlation Incident response automation Log aggregation Dashboard visualization Incorrect Log aggregation collects logs. 1 point Question 3 How does network architecture influence the management of file structures in security operations? It determines the physical location of file servers. It ensures that all files are encrypted. It reduces the complexity of file management. It helps implement access controls and permissions. Correct Network architecture helps implement access controls and permissions. 1 / 1 point 4. Question 4 If you need to automate the response to a phishing email detected in your organization, which SOAR feature would you use? Threat intelligence sharing Playbook automation Incident reporting Case management Correct Playbook automation executes predefined actions. 1 / 1 point 5. Question 5 How does on-premises network architecture influence the implementation of security controls? It determines the placement of firewalls and intrusion detection systems. It eliminates the need for network segmentation. It ensures that all users have administrative access. It reduces the complexity of network management. Correct On-premises network architecture determines the optimal placement of firewalls and intrusion detection systems. 1 / 1 point 6. Question 6 A file is suspected to be part of a malware campaign. Which sandboxing capability would help you determine if the file is malicious? Behavioral analysis Heuristic analysis Signature matching Threat intelligence integration Incorrect Signature matching compares known threats. 1 point Question 7 How does network architecture influence the effectiveness of a zero-trust security model? It ensures that all devices are connected to the same network. It reduces the need for monitoring and logging. It helps segment the network to limit the lateral movement of threats. It determines the physical location of security personnel. Correct Network architecture plays a key role in segmenting the network, which is essential for limiting the lateral movement of threats in a zero-trust model. 1 / 1 point Question 8 How does network architecture influence the deployment of multifactor authentication (MFA) in a security operation? It reduces the need for encryption. It helps ensure secure communication between authentication factors and servers. It determines the physical location of authentication servers. It ensures that all users are on the same network. Correct Network architecture helps ensure secure communication between authentication factors and servers. 1 / 1 point Question 9 Why is understanding system and network architecture important for implementing Single Sign-On (SSO) in an organization? It helps integrate SSO with existing identity and access management systems. It ensures that all users have the same password. It reduces the need for user authentication. It allows for the installation of more physical security devices. Correct Understanding system and network architecture helps integrate SSO with existing identity and access management systems. 1 / 1 point 10. Question 10 How does network architecture influence the effectiveness of Public Key Infrastructure (PKI) in a security operation? It reduces the need for encryption. It helps ensure secure communication between entities using digital certificates. It ensures that all devices are connected to the same network. It determines the physical location of certificate authorities (CAs). Correct Network architecture helps ensure secure communication between entities using digital certificates. 1 / 1 point Question 11 How does network architecture influence the deployment of Data Loss Prevention (DLP) solutions? It determines the physical location of DLP servers. It ensures that all devices are connected to the same network. It helps ensure the secure monitoring and control of data across the network. It reduces the need for data classification. Correct Network architecture helps ensure the secure monitoring and control of data across the network. 1 / 1 point 12. Question 12 How does network architecture influence the effectiveness of security measures for protecting PII? It ensures all devices storing PII are on the same network. It reduces the need to monitor and log PII access. It determines the physical location of PII storage. It helps implement network segmentation to limit access to PII. Correct Network architecture is used to implement network segmentation, limiting access to PII and improving security because it isolates sensitive data. 1 / 1 point Question 13 Why is identity and access management (IAM) important in security operations? It controls who has access to what resources and ensures proper authentication. It enhances the visual appeal of security dashboards. It simplifies the user interface of security applications. It speeds up the processing of security alerts. Correct IAM is crucial for managing user identities and enforcing access controls. 1 / 1 point 14. Question 14 Your network monitoring tools have detected an unknown device generating unusual traffic patterns and attempting to access sensitive files. What could be a potential indicator of malicious activity in this scenario? The device is a rogue device attempting unauthorized access. The device is a printer sending print jobs. The device is a new employee’s laptop being set up. The device is undergoing routine software updates. Correct An unknown device generating unusual traffic patterns and attempting to access sensitive files is a strong indicator of a rogue device attempting unauthorized access. 1 / 1 point Question 15 What characterizes a Professional Insider? An employee who involuntarily leaks data through a phishing scam An external consultant who mismanages company secrets A high-profile executive leaking information for a political cause An individual recruited for espionage within an organization Incorrect A high-profile executive might leak information for various reasons. 1 point 16. Question 16 Your network monitoring tools have detected traffic on port 8080, which is not typically used in your network environment. What could be a potential indicator of malicious activity in this scenario? The traffic is part of a legitimate software update. The traffic is from a new application that was recently installed. The traffic is from a rogue application attempting to bypass security controls. The traffic is from a scheduled network scan. Correct Traffic on an unexpected port, such as port 8080, could indicate a rogue application attempting to bypass security controls. 1 / 1 point Question 17 What is whaling? An environmental campaign to protect marine life A type of cyberattack targeting regular employees A specialized form of spear phishing aimed at high-profile targets like executives The act of stealing large data sets Correct Whaling specifically targets high-profile individuals within an organization. 1 / 1 point 18. Question 18 Your security team notices several workstations are experiencing rapid drive capacity consumption, even though no large files have recently been added. What could be a potential indicator of malicious activity in this scenario? The workstations are idle and not in use. The workstations are being used for legitimate high-storage tasks. The workstations are downloading software updates. The workstations are infected with malware that generates large logs or temporary files. Correct Rapid drive capacity consumption could indicate that the workstations are infected with malware generating large or temporary log files. 1 / 1 point Question 19 Your security team notices a process on multiple workstations attempting to connect to an external IP address known for malicious activity. What could be a potential indicator of malicious activity in this scenario? The process is a legitimate software update. The process is a rogue application attempting to exfiltrate data. The process is part of a legitimate cloud synchronization service. The process is a routine network scan. Correct A process on multiple workstations attempting to connect to an external IP address known for malicious activity could indicate a rogue application. 1 / 1 point 20. Question 20 Your security team notices that several workstations send large amounts of data to an external server during off-peak hours, which is unusual for your network’s normal operations. What could be a potential indicator of malicious activity in this scenario? The workstations are performing scheduled data backups. The workstations are idle and not in use. The workstations are exfiltrating data to an unauthorized external server. The workstations are downloading software updates. Correct Large data transfers to an external server during off-peak hours could indicate data exfiltration to an unauthorized external server. Question 21 Your security team has noticed unexpected changes in file permissions on several workstations and new hidden files appearing in system directories. What could be a potential indicator of malicious activity in this scenario? The changes are part of a legitimate system optimization process. The changes are from a scheduled disk cleanup. The changes indicate a malware infection attempting to gain persistence. The changes are due to IT's new software installation. Correct Unexpected changes in file permissions and new hidden files appearing in system directories could indicate a malware infection. 1 / 1 point Question 22 Your security team notices an application generating an unusually high number of outbound connections to various external IP addresses. What could be a potential indicator of malicious activity in this scenario? The application is performing routine updates. The application is syncing data with a legitimate cloud service. The application is idle and not in use. The application is part of a distributed denial-of-service (DDoS) attack. Correct An application generating an unusually high number of outbound connections to various external IP addresses could indicate it is part of a distributed denial-of-service (DDoS) attack. 1 / 1 point Question 23 Your security team has noticed a new administrative account created for an application without any corresponding request or approval. What could be a potential indicator of malicious activity in this scenario? The account is for a temporary contractor. An attacker has created the account to gain elevated privileges. The account was created for a legitimate system upgrade. The account is part of a planned expansion of administrative privileges. Correct Several new user accounts created outside of regular business hours could indicate that an attacker is creating unauthorized accounts to gain access to the application. 1 / 1 point 24. Question 24 Your network monitoring tools have detected a sudden increase in outbound traffic from a workstation to an unfamiliar external IP address. What could be a potential indicator of malicious activity in this scenario? The workstation is exfiltrating data to an unauthorized external destination. The workstation is downloading updates from a legitimate source. The workstation is syncing files with a known internal server. The workstation is performing a scheduled backup. Correct A sudden increase in outbound traffic to an unfamiliar external IP address could indicate data exfiltration. 1 / 1 point 25. Question 25 Your network monitoring tools have detected unusual DNS queries from a workstation to an external IP address. You decide to use Wireshark to investigate further. What could be a potential indicator of malicious activity in this scenario? The DNS queries are part of a legitimate software update. The DNS queries are from a scheduled network scan. The DNS queries are from a legitimate cloud service synchronization. The DNS queries indicate DNS tunneling used for data exfiltration. Correct Unusual DNS queries to an external IP address could indicate DNS tunneling. 1 / 1 point 26. Question 26 Which of the following security operations tasks are ideal for automation? Security application user errors: Search the error logs for signs of users having trouble with the security application. Look up the user’s phone number. Call the user to help with any questions about using the application. Firewall IoC block actions: Examine the firewall logs from the most recently published zero-day exploit for IoCs. Take mitigating actions in the firewall to block the behavior in the logs. Follow up on any false positives that were caused by the block rules. Suspicious file analysis: Look for suspicious-looking graphics in a folder. Create subfolders in the original folder based on the category of graphics found. Move the suspicious graphics to the appropriate subfolder. Email header analysis: Check the email header for a phishing confidence metric greater than or equal to five. Add the sender's domain to the block list. Move the email to quarantine. Incorrect Firewall IoC block actions: Automation can help, but follow-up on false positives often requires human intervention. 1 point 27. Question 27 Your SOAR platform has detected multiple alerts indicating unusual login attempts from various geographic locations for a single user account within a short time frame. What could be a potential indicator of malicious activity in this scenario? The user is updating their profile information. The user is traveling and accessing the system from different locations. The user account is compromised and used in a credential-stuffing attack. The user is performing routine maintenance tasks. Correct Multiple login attempts from various geographic locations for a single user account within a short time frame could indicate the account is compromised. 1 / 1 point 28. Question 28 Your EDR tool has detected a process running in memory that is not associated with any known executable files on the disk. What could be a potential indicator of malicious activity in this scenario? The process is part of a legitimate software update. The process is a scheduled system backup. The process is a routine network scan. The process is a fileless malware attack operating in memory. Correct A process running in memory without any associated executable files on the disk could indicate a fileless malware attack. 1 / 1 point 29. Question 29 Your network monitoring tools have detected HTTP requests with uncommon header types from an internal server to an external IP address. What could be a potential indicator of malicious activity in this scenario? The server is infected with malware attempting to communicate with a command and control server. The server is undergoing routine maintenance. The server is performing a legitimate software update. The server is syncing data with a cloud service. Correct HTTP requests with uncommon header types from an internal server to an external IP address could indicate that the server is infected with malware. 1 / 1 point 30. Question 30 Your user behavior analysis tool has flagged a user who is suddenly downloading large amounts of data, which is unusual for their typical behavior. What could be a potential indicator of malicious activity in this scenario? The user is performing a legitimate data backup. The user is exfiltrating data, indicating a potential insider threat. The user is syncing data with a cloud service. The user is undergoing routine software updates. Correct Sudden large data downloads that deviate from a user’s typical behavior could indicate data exfiltration. 1 / 1 point 31. Question 31 Your organization has recently deployed a new set of servers. As a security analyst, you must ensure these assets are correctly identified and assessed for vulnerabilities. Which tools would be most appropriate for discovering and cataloging these new assets in your network? Metasploit Nmap Wireshark Burp Suite Incorrect Mainly used for web application security testing, not for discovering network assets. 1 point 32. Question 32 After a recent security incident, your organization decided to perform a comprehensive assessment of internal systems to identify any vulnerabilities that could be exploited by insiders or malware. Which type of vulnerability scan is most appropriate for identifying weaknesses within your internal network? External Vulnerability Scan Compliance Scan Internal Vulnerability Scan Penetration Test Correct An internal vulnerability scan examines the internal network for vulnerabilities that could be exploited by insiders or malware. 1 / 1 point 33. Question 33 Your organization has a mix of on-premises servers and cloud-based virtual machines. You must perform regular vulnerability scans without installing additional software on each machine. Which scanning method would be most suitable for this scenario? Non-credentialed scanning Credentialed scanning Agentless scanning Agent-based scanning Correct Agentless scanning uses network protocols to gather information without installing software on each machine. 1 / 1 point 34. Question 34 You need to assess the security posture of your internal network. Which scanning method would be most appropriate? Internal scan Penetration test External scan Social engineering test Correct Internal scans evaluate internal vulnerabilities. 1 / 1 point 35. Question 35 After deploying a new security baseline profile, your organization needs to continuously monitor and ensure compliance with this profile across all endpoints. Which feature of security baseline scanning allows continuous monitoring and real-time compliance assessment? Continuous baseline assessment Scheduled scans Real-time alerts Manual audits Correct Continuous baseline assessment allows ongoing monitoring and real-time compliance checks against the security baseline profile. 1 / 1 point 36. Question 36 An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot, resulting in a single downtime window. However, two critical systems cannot be upgraded due to a vendor appliance that the company cannot access. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent? Lack of maintenance windows Unsupported operating systems Legacy systems Proprietary systems Correct Vendor appliances often have proprietary constraints that limit the ability to upgrade or patch them. 1 / 1 point 37. Question 37 You need to implement a control to prevent unauthorized access to sensitive data. Which type of control would you use? Preventive Corrective Compensating Detective Correct Preventative controls stop incidents before they occur. 1 / 1 point 38. Question 38 Your organization has identified a critical vulnerability in its web application. To prevent exploitation, you implement a control restricting access to vulnerable components. Which type of control is being implemented in this scenario? Managerial control Operational control Technical control Preventative control Correct Preventative controls are designed to stop security incidents before they occur. 1 / 1 point 39. Question 39 You need to standardize system settings across your organization to reduce security risks. Which process would you use? Configuration management Risk assessment Patch management Security auditing Correct Configuration management standardizes settings. 1 / 1 point 40. Question 40 You need to prioritize vulnerabilities based on their potential impact. Which risk management principle would you apply? Risk mitigation Risk assessment Risk transfer Risk avoidance Correct Risk assessment evaluates and prioritizes risks. 1 / 1 point 41. Question 41 Your organization aims to maintain a high level of security by ensuring that all critical vulnerabilities are addressed within a specified timeframe. This goal is part of your SLOs. Which type of SLO metric is being used to measure the effectiveness of your vulnerability management process? Customer satisfaction Incident frequency Service uptime Mean Time to Repair (MTTR) Correct MTTR measures the average time taken to repair or address vulnerabilities. 1 / 1 point 42. Question 42 Your organization aims to reduce the number of potential vulnerabilities by disabling unnecessary services and closing open ports on all systems. Which attack surface management method is being applied in this scenario? Passive discovery Edge discovery Attack surface reduction Pen testing Correct Attack surface reduction involves minimizing the number of potential entry points. 1 / 1 point 43. Question 43 You need to ensure that your code is free from common vulnerabilities. Which practice should you follow? Code obfuscation Input validation Code minification Code formatting Correct Input validation prevents injection attacks. 1 / 1 point 44. Question 44 During the development phase of a new application, your team needs to ensure that security is integrated from the beginning to prevent vulnerabilities. Which SDLC phase focuses on defining security requirements and planning for secure development? Design Testing Implementation Planning Correct The planning phase involves defining security requirements and planning for secure development. 1 / 1 point 45. Question 45 In which phase of the Cyber Kill Chain does the attacker establish a backdoor to maintain access to the compromised system? Command and control Installation Delivery Actions on objectives Correct During the Installation phase, the attacker installs malware or other tools to establish a backdoor for persistent access. 1 / 1 point 46. Question 46 Which component of the MITRE ATT&CK framework represents the “why” behind an adversary’s actions? Procedures Tools Techniques Tactics Incorrect Procedures are the specific steps or methods used by adversaries. 1 point 47. Question 47 You are documenting the chain of custody for a USB drive collected during an investigation. Which information is NOT typically required in the chain of custody documentation? Detailed analysis of the data on the USB drive Serial number of the USB drive Date and time of collection Name of the person who collected the evidence Correct Chain of custody documentation focuses on tracking the evidence, not analyzing its contents. 1 / 1 point 48. Question 48 After successfully containing a malware outbreak, what is the next step in the incident response process? Documentation Recovery Eradication Analysis Correct After containment, the next step is eradication, which involves removing the malware from all affected systems and addressing the root cause. 1 / 1 point 49. Question 49 What is the primary goal of the post-incident activity phase in an incident response plan? To contain the incident and prevent further damage To document lessons learned and improve future response efforts To eradicate the threat from the affected systems To notify stakeholders about the incident Correct The primary goal of the post-incident activity phase is to document lessons learned and improve future response efforts. 1 / 1 point 50. Question 50 Which of the following is the primary objective of conducting tabletop exercises during the preparation phase of incident management? To restore systems to regular operation after an incident To practice and improve the incident response plan To perform a full-scale simulation of an incident To identify and fix vulnerabilities in the network Correct During preparation, tabletop exercises are designed to practice and refine the incident response plan by simulating various scenarios. 1 / 1 point 51. Question 51 Daisy Electrics conducts weekly vulnerability scanning of its network and patches any identified issues within 24 hours. Which of the following best describes the company’s risk response strategy? Acceptance Avoidance Transference Mitigation Incorrect Acceptance involves accepting the risk without action. 1 point 52. Question 52 What is a key benefit of reporting on vulnerabilities and configuration management actions? It helps in identifying new software updates. It reduces the need for manual security checks. It increases the speed of incident response. It ensures compliance with security policies and standards. Correct Reporting on vulnerabilities and configuration management actions helps ensure that systems comply with security policies and standards. 1 / 1 point 53. Question 53 What is the key benefit of communicating patching action plans to all relevant stakeholders? It ensures that all stakeholders are aware of potential downtime and security improvements. It allows stakeholders to apply patches manually. It reduces the overall number of vulnerabilities in the system. It eliminates the need for automated patch management tools. Correct Communicating patching action plans helps stakeholders understand the impact on system availability. 1 / 1 point 54. Question 54 What is a key benefit of communicating compensating controls to relevant stakeholders? It eliminates the need for future patching. It reduces the overall number of vulnerabilities in the system. It allows stakeholders to bypass security protocols. It ensures stakeholders are aware of temporary measures and their limitations. Correct Communicating compensating controls helps stakeholders understand the temporary measures in place and their limitations. 1 / 1 point 55. Question 55 During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which recommendation would best mitigate this problem if applied during the SDLC phase? Conduct regular red team exercises over the application in production Implement proper input validation for any data entry form Use application security scanning as part of the CI/CD flow pipeline Ensure that all implemented coding libraries are regularly checked Incorrect While important, checking libraries does not address the continuous nature of the vulnerabilities. 1 point 56. Question 56 Why is it essential to update vulnerability management action plans in response to changing business requirements? To eliminate the need for security training To align security measures with current business operations and risks To ensure compliance with outdated security policies To reduce the frequency of vulnerability scans Correct Updating action plans ensures that security measures are relevant and effective in addressing the current business environment. 1 / 1 point 57. Question 57 What is a key benefit of effective communication with stakeholders during an incident? It reduces the need for incident response teams. It allows stakeholders to ignore the incident. It eliminates the need for post-incident reviews. It ensures coordinated efforts and informed decision-making. Correct Effective communication with stakeholders ensures that everyone involved is informed. 1 / 1 point 58. Question 58 Why is a Memorandum of Understanding (MOU) important in incident response planning? To ensure all incidents are resolved internally without external help To eliminate the need for regular communication between organizations To establish clear roles and responsibilities for collaborative response efforts To create legally binding agreements between organizations Correct An MOU helps define the roles and responsibilities of each party involved. 1 / 1 point 59. Question 59 What is a key benefit of communicating SLA metrics to stakeholders during an incident? It eliminates the need for post-incident reviews. It allows stakeholders to ignore the incident. It ensures transparency and sets clear expectations for incident resolution. It reduces the need for incident response teams. Correct Communicating SLA metrics provides transparency and sets clear expectations for how and when incidents will be resolved. 1 / 1 point 60. Question 60 What is a crucial benefit of communicating the status and risks of legacy systems to stakeholders? It ensures stakeholders are aware of potential risks and necessary mitigation strategies. It allows stakeholders to ignore legacy systems. It reduces the overall number of legacy systems in use. It eliminates the need for future incident response plans. Correct Communicating the status and risks of legacy systems helps stakeholders understand the potential threats. 1 / 1 point 61. Question 61 Why is it important to include proprietary systems in incident response plans? To reduce the need for regular system updates To address unique vulnerabilities and dependencies specific to proprietary systems To eliminate the use of proprietary systems To ensure all systems are open-source Correct Proprietary systems often have unique vulnerabilities and dependencies. 1 / 1 point 62. Question 62 What is a key benefit of effective communication with stakeholders during an incident? It ensures coordinated efforts and informed decision-making. It reduces the need for incident response teams. It allows stakeholders to ignore the incident. It eliminates the need for post-incident reviews. Correct Effective stakeholder communication ensures that everyone involved is informed and can coordinate their efforts. 1 / 1 point 63. Question 63 What is a crucial benefit of having an effective incident escalation policy? It allows incidents to be ignored if they are not severe. It ensures that the appropriate personnel addresses incidents. It reduces the need for incident response teams. It eliminates the need for post-incident reviews. Correct An effective incident escalation policy ensures that incidents are escalated to the proper personnel based on their severity and complexity. 1 / 1 point 64. Question 64 Why is the executive summary an essential part of an incident response report? To include all raw data and logs collected during the incident To offer a high-level overview for stakeholders and decision-makers To provide a detailed technical analysis of the incident To list all the vulnerabilities found during the incident Correct The executive summary provides a concise, high-level overview of the incident. 1 / 1 point 65. Question 65 What is a key benefit of communicating the impact of an incident to stakeholders? It reduces the need for incident response teams. It allows stakeholders to ignore the incident It eliminates the need for post-incident reviews. It ensures stakeholders understand the severity and necessary actions. Correct Communicating the impact of an incident helps stakeholders grasp the severity and the actions required to address the situation effectively. 1 / 1 point 66. Question 66 What is a key benefit of clear legal communication during an incident response? It eliminates the need for incident response teams. It ensures accurate and compliant public disclosures. It allows the organization to ignore regulatory requirements. It reduces the need for technical analysis. Correct Clear legal communication ensures that public disclosures are accurate and comply with regulatory requirements. 1 / 1 point 67. Question 67 What is a key benefit of regulatory reporting during an incident response? It allows the organization to ignore the incident. It ensures authorities are informed and can provide support if needed. It eliminates the need for post-incident reviews. It reduces the need for incident response teams. Correct Regulatory reporting ensures that authorities are informed about the incident. 1 / 1 point 68. Question 68 Why is it important to involve law enforcement in incident response communications? To avoid communicating with external stakeholders To comply with legal requirements and facilitate coordinated responses To reduce the need for incident documentation To ensure technical issues are resolved quickly Correct Compliance with legal requirements facilitates coordinated responses and improves overall incident management. 1 / 1 point 69. Question 69 What is a key benefit of reducing an organization's Mean Time to Detect (MTTD)? It reduces the need for incident response teams. It eliminates the need for regular security assessments. It minimizes the impact and potential damage of security incidents. It allows the organization to ignore minor incidents. Correct Reducing MTTD helps quickly identify and mitigate security incidents. 1 / 1 point 70. Question 70 What is a key benefit of reducing an organization's Mean Time to Respond (MTTR)? It reduces the need for incident response teams. It eliminates the need for regular security assessments. It allows the organization to ignore minor incidents. It minimizes the impact and potential damage of security incidents. Correct Reducing MTTR helps address and mitigate security incidents quickly. 1 / 1 point 71. Question 71 Why is Mean Time to Remediate (MTTR) a critical metric in incident response? To assess how quickly an organization can fix vulnerabilities and mitigate risks To evaluate the effectiveness of post-incident reviews To determine the total downtime caused by an incident To measure the time taken to detect an incident Correct MTTR measures the average time it takes to remediate vulnerabilities. 1 / 1 point 72. Question 72 What is the primary purpose of threat intelligence? To manage user access controls To identify vulnerabilities in software To perform data backups To predict and prevent cyberthreats Correct Threat intelligence helps understand potential threats and take proactive measures to prevent them. 1 / 1 point 73. Question 73 What is the first step in a vulnerability management process? Reporting Scanning Remediation Identification Incorrect Scanning detects vulnerabilities but is not the first step. 1 point 74. Question 74 During which phase of incident response is the root cause analysis performed? Recovery Containment Detection Eradication Correct Root cause analysis is done during eradication to ensure the threat is completely removed. 1 / 1 point 75. Question 75 Which of the following is a benefit of using a SIEM system? Reduced network latency Simplified user management Improved incident detection Enhanced data encryption Correct SIEM systems enhance the ability to detect incidents through log analysis. 1 / 1 point 76. Question 76 Which regulation focuses on protecting personal data in the European Union? SOX PCI DSS GDPR HIPAA Correct GDPR is the EU regulation for data protection. 1 / 1 point 77. Question 77 After observing the attacker, Alice removes the Internet connection entirely, leaving the systems running but inaccessible outside the quarantine VLAN. What strategy is she now pursuing? Eradication Segmentation Isolation Removal Correct Disconnecting the Internet isolates the system from external access. 1 / 1 point 78. Question 78 What is the purpose of a demilitarized zone (DMZ) in network architecture? To manage user credentials To encrypt network traffic To store backup data To isolate public-facing services Correct A DMZ separates public-facing services from the internal network. 1 / 1 point 79. Question 79 You need to ensure effective communication with stakeholders during an incident. Which method is most appropriate for real-time updates? Instant Messaging Phone Calls Monthly Reports Email Correct Instant messaging provides real-time updates. 1 / 1 point 80. Question 80 What is the principle of least privilege? Encrypting all user data Granting users minimal access necessary to perform their jobs Allowing all users full access to all resources Regularly changing user passwords Correct The principle of least privilege restricts user access to only what is necessary. 1 / 1 point 81. Question 81 After resolving an incident, you need to create a report. What is the primary purpose of this report? To document the incident and response To blame the responsible party To archive the incident To notify the media Correct Documenting the incident and response ensures accountability and learning. 1 / 1 point 82. Question 82 Which type of firewall filters traffic based on packet attributes? Packet-filtering firewall Proxy firewall Stateful firewall Application firewall Incorrect Application firewalls filter traffic based on application data, not packet attributes. 1 point 83. Question 83 What is a common security concern in cloud computing? Physical theft Software updates Hardware failure Data breaches Correct Data breaches are a significant concern in cloud environments. 1 / 1 point 84. Question 84 Which of the following is a common method for assessing risk? Data encryption Vulnerability scanning User training Incident response Correct Vulnerability scanning helps identify potential risks. 1 / 1 point 85. Question 85 Which of the following is a benefit of regular security awareness training? Increased network speed Reduced risk of human error Enhanced data encryption Simplified compliance audits Correct Regular training helps reduce the risk of human error in security practices.