Continuous Monitoring & Incident Response Flashcards
7 cards from real CDP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Continuous Monitoring & Incident Response flashcards as text
Which SIEM capability allows security analysts to correlate events from multiple sources to detect complex attack patterns?
Answer: Event correlation rules
Event correlation rules in a SIEM link related events across sources to identify multi-step attack patterns that individual alerts would miss.
During a DevSecOps pipeline breach, the incident commander declares a P1 incident. What should happen FIRST?
Answer: Isolate affected systems to contain the breach
Containment is the immediate priority to prevent further damage before moving on to evidence collection or analysis.
A security team wants to detect cryptominer deployments in Kubernetes pods in real time. Which monitoring approach is most effective?
Answer: Runtime behavioral monitoring for anomalous CPU spikes and outbound connections
Runtime behavioral monitoring catches cryptominers by detecting the characteristic CPU exhaustion and unauthorized outbound network connections they produce.
What is the primary purpose of a runbook in incident response?
Answer: To provide step-by-step procedures for handling specific incident types
A runbook provides pre-approved, repeatable procedures so responders act consistently and quickly without improvising during high-stress incidents.
Which metric best measures the effectiveness of a continuous monitoring program in a CI/CD environment?
Answer: Mean Time to Detect (MTTD) security anomalies
MTTD measures how quickly the monitoring program surfaces real threats, directly reflecting its detection effectiveness.
An attacker exfiltrates data via DNS tunneling. Which monitoring control would most likely detect this?
Answer: DNS query volume and entropy analysis
DNS tunneling produces abnormally high query volumes and high-entropy domain names that are detectable through DNS traffic analysis.
In a shift-left security model, when should security monitoring configurations be defined?
Answer: During the design and development phase as code (IaC)
Shift-left embeds monitoring configuration as infrastructure-as-code during development so alerts and dashboards are ready at deployment.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- practical-devsecops.com — Test delivery, eligibility, time limit, score validity, fees, registration deadline, renewal, retake fee, retake policy, test dates · verified Oct 2026