CyberVista Security Operations and Monitoring Questions and Answers

Question 1

A Security Operations Center (SOC) analyst is overwhelmed with a high volume of alerts from various security tools.
To improve efficiency and reduce response times, management decides to implement a solution that can aggregate data from different systems and automate response actions based on predefined playbooks.
Which of the following technologies BEST describes this solution?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR)

Answer

Security Information and Event Management (SIEM)

Answer

Intrusion Detection System (IDS)

Answer

Vulnerability Scanner

Question 2

According to the NIST Special Publication 800-61, which phase of the incident response lifecycle involves learning from a security incident and implementing improvements to prevent its recurrence?

Accepted Answer

Post-Incident Activity

Answer

Containment, Eradication, & Recovery

Answer

Detection & Analysis

Answer

Preparation

Question 3

A cybersecurity analyst receives a threat intelligence report detailing the specific Tactics, Techniques, and Procedures (TTPs) used by a newly identified advanced persistent threat (APT) group that targets financial institutions. What type of threat intelligence is this?

Accepted Answer

Operational

Answer

Strategic

Answer

Technical

Answer

Tactical

Question 4

During a routine security audit, a vulnerability scanner identifies a critical cross-site scripting (XSS) flaw in a public-facing web application. Which of the following tools would be MOST appropriate for this type of discovery?

Accepted Answer

Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP)

Answer

Network Mapper (e.g., Nmap)

Answer

Container Scanner (e.g., Trivy)

Answer

Static Application Security Testing (SAST) tool

Question 5

A SOC team is configuring its logging and monitoring strategy. Which of the following is a primary goal of continuous monitoring in a security operations context?

Accepted Answer

To maintain ongoing awareness of the organization's security posture and risks.

Answer

To perform a one-time, comprehensive security audit of all systems.

Answer

To replace the need for an incident response plan.

Answer

To exclusively track the performance and uptime of network hardware.

Question 6

An organization has successfully contained a malware outbreak by isolating the affected systems from the network. According to the NIST incident response lifecycle, what is the immediate NEXT step the security team should take?

Accepted Answer

Eradication

Answer

Preparation

Answer

Post-Incident Activity

Answer

Detection & Analysis