CDP Continuous Monitoring & Incident Response 2 — Questions and Answers
Question 1: Which SIEM capability allows security analysts to correlate events from multiple sources to detect complex attack patterns?
- Log aggregation
- Event correlation rules (Correct answer)
- Data normalization
- Alert deduplication
Correct answer: Event correlation rules
Event correlation rules in a SIEM link related events across sources to identify multi-step attack patterns that individual alerts would miss.
Question 2: During a DevSecOps pipeline breach, the incident commander declares a P1 incident. What should happen FIRST?
- Begin root cause analysis
- Notify executive leadership
- Isolate affected systems to contain the breach (Correct answer)
- Collect forensic evidence
Correct answer: Isolate affected systems to contain the breach
Containment is the immediate priority to prevent further damage before moving on to evidence collection or analysis.
Question 3: A security team wants to detect cryptominer deployments in Kubernetes pods in real time. Which monitoring approach is most effective?
- Weekly vulnerability scans of container images
- Runtime behavioral monitoring for anomalous CPU spikes and outbound connections (Correct answer)
- Static analysis of Dockerfiles
- Periodic review of pod resource quotas
Correct answer: Runtime behavioral monitoring for anomalous CPU spikes and outbound connections
Runtime behavioral monitoring catches cryptominers by detecting the characteristic CPU exhaustion and unauthorized outbound network connections they produce.
Question 4: What is the primary purpose of a runbook in incident response?
- To document post-incident lessons learned
- To provide step-by-step procedures for handling specific incident types (Correct answer)
- To assign blame and accountability after an outage
- To track SLA compliance metrics
Correct answer: To provide step-by-step procedures for handling specific incident types
A runbook provides pre-approved, repeatable procedures so responders act consistently and quickly without improvising during high-stress incidents.
Question 5: Which metric best measures the effectiveness of a continuous monitoring program in a CI/CD environment?
- Number of security tools installed
- Mean Time to Detect (MTTD) security anomalies (Correct answer)
- Lines of security code reviewed per sprint
- Percentage of infrastructure with logging enabled
Correct answer: Mean Time to Detect (MTTD) security anomalies
MTTD measures how quickly the monitoring program surfaces real threats, directly reflecting its detection effectiveness.
Question 6: An attacker exfiltrates data via DNS tunneling. Which monitoring control would most likely detect this?
- Web application firewall log analysis
- DNS query volume and entropy analysis (Correct answer)
- TLS certificate monitoring
- Container image vulnerability scanning
Correct answer: DNS query volume and entropy analysis
DNS tunneling produces abnormally high query volumes and high-entropy domain names that are detectable through DNS traffic analysis.
Question 7: In a shift-left security model, when should security monitoring configurations be defined?
- After deployment to production
- During the design and development phase as code (IaC) (Correct answer)
- During the staging environment QA pass
- At the start of each quarterly security review
Correct answer: During the design and development phase as code (IaC)
Shift-left embeds monitoring configuration as infrastructure-as-code during development so alerts and dashboards are ready at deployment.
CDP Continuous Monitoring & Incident Response 2
Which SIEM capability allows security analysts to correlate events from multiple sources to detect complex attack patterns?