Improve SOC Incident Response Time
28 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What can block an attack at Layer 7?

  • NAC
  • WAF (correct)
  • HSM
  • HIDS
  • How can a business operations manager mitigate concerns about a PC hardware failure?

  • Purchase cybersecurity insurance
  • Implement a full system upgrade
  • Perform a physical-to-virtual migration (correct)
  • Install uninterruptible power supplies
  • What is the BEST action to prevent reinfection from an infection vector on an internet-facing Windows server?

  • Create a firewall rule that blocks port 22 from the internet to the server
  • Prevent connections over TFTP from the internal network
  • Disable file sharing over port 445 to the server
  • Block port 3389 inbound from untrusted networks (correct)
  • Which of the following actions is commonly used to prevent malware reinfection?

    <p>Implementing application whitelisting</p> Signup and view all the answers

    What technology uses SAML for authentication?

    <p>Federation</p> Signup and view all the answers

    In cybersecurity, which technology is specifically designed to protect web applications?

    <p>NIDS</p> Signup and view all the answers

    What should the SOC consider to BEST improve its response time?

    <p>Implement a SOAR with customizable playbooks</p> Signup and view all the answers

    In the context of validating transactions securely, which solution is the BEST to adopt?

    <p>PKI</p> Signup and view all the answers

    What technology BEST meets the requirements of providing centralized infrastructure management and consistent user desktop experience?

    <p>VDI</p> Signup and view all the answers

    To enhance incident response time, what should be done with OSINT artifacts?

    <p>Catalog them in a central repository</p> Signup and view all the answers

    Which technology is NOT typically used for transaction validation and artifact issuance?

    <p>OAuth</p> Signup and view all the answers

    What method should be recommended to reduce the need for constant replacement of aging end-user machines?

    <p>Implementing VDI environments</p> Signup and view all the answers

    After discovering large data exfiltration during a penetration test, what should be the client's NEXT step to mitigate the issue?

    <p>Perform containment on the critical servers and resources</p> Signup and view all the answers

    What type of controls should a security analyst implement to limit unauthorized access to a physical site with the lowest possible budget?

    <p>Deterrent controls</p> Signup and view all the answers

    A company is migrating servers to the cloud to reduce its technology footprint. Which solution will require the LEAST management and support?

    <p>SaaS</p> Signup and view all the answers

    Who is responsible for protecting an organization's collected personal information?

    <p>Data Protection Officer</p> Signup and view all the answers

    What was the reason a RAM image could not be taken?

    <p>The computer was turned off</p> Signup and view all the answers

    To compare biometric solutions for the highest likelihood of denying unauthorized access, what should an organization focus on?

    <p>FRR</p> Signup and view all the answers

    In the case of a data leak involving proprietary information, what is the BEST remediation approach?

    <p>CASB</p> Signup and view all the answers

    In the scenario where an attacker spoofed the IP address associated with a shopping site, which attack took place?

    <p>On-path attack</p> Signup and view all the answers

    What was confirmed about the corporate network in the data leak incident involving the COPE tablet?

    <p>It was secure</p> Signup and view all the answers

    When a company is considering transitioning to the cloud, what aspect should be evaluated?

    <p>Network security</p> Signup and view all the answers

    What type of malware is MOST likely causing the repeated deletion of files when the Chief Financial Officer logs in to the file server?

    <p>Logic bomb</p> Signup and view all the answers

    After identifying malware spreading through the corporate network, what should the analyst do NEXT?

    <p>Attempt to quarantine all infected hosts to limit further spread</p> Signup and view all the answers

    What caused the company to realize it was still vulnerable despite applying rules to inbound traffic and implementing ACLs on critical servers?

    <p>Outbound traffic not being restricted</p> Signup and view all the answers

    In which stage of the Cyber Kill Chain is the adversary currently operating if they are able to maintain a presence in the network?

    <p>Command and control</p> Signup and view all the answers

    What would be the most appropriate action for preventing similar issues in the future after a logic bomb incident?

    <p>Monitoring system logs for unusual activities</p> Signup and view all the answers

    Why is it important for a security analyst to activate the CSIRT after identifying malware spreading through the corporate network?

    <p>To involve a response team with expertise in handling security incidents</p> Signup and view all the answers

    More Like This

    Use Quizgecko on...
    Browser
    Browser