Which of the following best describes the motivation of a worker who steals proprietary data to sell to a competitor?
The motivation for the worker's actions is financial gain, as the worker intends to profit by selling proprietary data to a competitor.
Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system?
SIEM stands for Security Information and Event Management. It is a security alerting and monitoring tool that collects logs from multiple sources, analyzes data, correlates events, generates alerts, and provides reports and dashboards to help detect and respond to cyber threats.
Which of the following actions could a security engineer take to ensure workstations and servers are properly configured for monitoring unauthorized changes and patching?
Endpoint management software allows for centralized monitoring and control of devices, including configuration management and patch deployment. This ensures that systems are properly configured and patched, reducing vulnerabilities and improving security posture.
Employees in R&D receive extensive training to protect company data. Which type of data are they most likely handling daily?
R&D teams primarily handle intellectual property, which must be safeguarded due to its competitive value.
A security analyst needs to monitor network traffic for suspicious patterns. Which tool should they use?
A protocol analyzer (packet sniffer) allows detailed examination of network traffic patterns and content for security analysis.
A company’s antivirus blocks malware but generates false positives, wasting investigation time. Which solution should replace the antivirus?
EDR (Endpoint Detection and Response) provides heuristic and behavioral analysis to detect threats beyond signature-based antivirus. This reduces false positives and improves visibility into root causes.
A security engineer would like to enhance the use of automation and orchestration within the SIEM. Which of the following would be the primary benefit of this enhancement?
Automation and orchestration enhance SIEM by automating tasks, which acts as a workforce multiplier, increasing efficiency.
Which of the following best describes the concept of log correlation?
Log correlation involves analyzing and combining logs from multiple sources to identify patterns indicative of security threats.
An organization is implementing a COPE mobile device management policy. Which of the following should the organization include in the COPE policy? (Select two).
COPE policies typically involve encrypting data on the device and allowing remote wipe to protect organizational data in case of loss or theft.
Which of the following describes the reason for using an MDM solution to prevent jailbreaking?
MDM can enforce policies that block jailbreaking or unauthorized OS modifications, ensuring devices run only approved firmware. This prevents users from bypassing security controls and installing unvetted apps.
Which of the following is the MOST effective way to secure DevOps pipelines?
Automation ensures consistent application of security controls throughout the pipeline and reduces human error.
Which of the following is used to monitor suspicious traffic in real time between multiple systems within an organization?
NetFlow records metadata about network conversations, including source, destination, and volume, and can be analyzed in real time to detect anomalies. It’s commonly used for network behavior analysis and threat detection.
While reviewing a recent compromise, a forensics team discovers there are hard-coded credentials in the database connection strings. Which of the following assessment types should be performed during software development to prevent this from reoccurring?
Static code analysis scans source files for insecure coding practices, like hard-coded credentials, before the application is compiled or deployed. This helps catch credential leaks early in the development lifecycle.
Which of the following activities uses OSINT?
OSINT (Open Source Intelligence) involves collecting publicly available information, such as social media, to test for social engineering vulnerabilities.
Which of the following phases of an incident response involves generating reports?
The lessons learned phase of incident response involves documenting the incident, analyzing the response, and generating reports to identify areas for improvement and prevent future incidents.
Quiz Complete!
Domain 4: Security Operations