CDP Continuous Monitoring & Incident Response 2

Question 1

Which SIEM capability allows security analysts to correlate events from multiple sources to detect complex attack patterns?

Accepted Answer

Event correlation rules

Answer

Event correlation rules in a SIEM link related events across sources to identify multi-step attack patterns that individual alerts would miss.

Question 2

During a DevSecOps pipeline breach, the incident commander declares a P1 incident. What should happen FIRST?

Accepted Answer

Isolate affected systems to contain the breach

Answer

Containment is the immediate priority to prevent further damage before moving on to evidence collection or analysis.

Question 3

A security team wants to detect cryptominer deployments in Kubernetes pods in real time. Which monitoring approach is most effective?

Accepted Answer

Runtime behavioral monitoring for anomalous CPU spikes and outbound connections

Answer

Runtime behavioral monitoring catches cryptominers by detecting the characteristic CPU exhaustion and unauthorized outbound network connections they produce.

Question 4

What is the primary purpose of a runbook in incident response?

Accepted Answer

To provide step-by-step procedures for handling specific incident types

Answer

A runbook provides pre-approved, repeatable procedures so responders act consistently and quickly without improvising during high-stress incidents.

Question 5

Which metric best measures the effectiveness of a continuous monitoring program in a CI/CD environment?

Accepted Answer

Mean Time to Detect (MTTD) security anomalies

Answer

MTTD measures how quickly the monitoring program surfaces real threats, directly reflecting its detection effectiveness.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Continuous Monitoring & Incident Response 2