CDP Continuous Monitoring & Incident Response 3

Question 1

Which artifact should be preserved FIRST when performing forensic analysis after a container compromise?

Accepted Answer

Running container memory snapshot and filesystem

Answer

A running container's volatile memory and ephemeral filesystem hold live attack evidence that is permanently lost once the container is stopped.

Question 2

What is the role of threat intelligence feeds in continuous monitoring?

Accepted Answer

Enriching alerts with known attacker TTPs and IOCs to prioritize response

Answer

Threat intelligence feeds supply indicators of compromise (IOCs) and tactics that help analysts decide which alerts represent real, active threats.

Question 3

A DevSecOps team receives an alert that a build server is communicating with a known command-and-control IP. Which incident response phase does the initial triage belong to?

Accepted Answer

Identification

Answer

Triage determines whether an alert represents a real incident, which is the identification phase of the NIST incident response lifecycle.

Question 4

Which practice reduces alert fatigue in a security operations center monitoring a DevSecOps pipeline?

Accepted Answer

Tuning alert rules using baselines and suppressing known-good patterns

Answer

Baselining normal behavior and suppressing known-good events reduces noise while preserving detection of genuine anomalies.

Question 5

What does a 'golden signal' approach to monitoring measure in microservices?

Accepted Answer

Latency, traffic, errors, and saturation

Answer

Google's four golden signals—latency, traffic, errors, and saturation—provide the minimal set of metrics needed to understand service health.

(CDP) Certified DevSecOps Professional Practice Test

(CDP) Certified DevSecOps Professional Practice Test

CDP Continuous Monitoring & Incident Response 3