312-39v2 Practice Test practice questions, page 6 of 8, with answer review and explanations.
Question 26
A rapidly growing e-commerce company wants to implement a SIEM solution to improve its security posture and comply with PCI DSS requirements. They need a solution that offers both the necessary technological features and the expertise to manage the system effectively. They also need to ensure continuous compliance support and data security assistance. Which of the following SIEM solutions is appropriate for this company?
Security analytics
Managed SIEM
In-house SIEM
Cloud-based SIEM
Question 27
A multinational corporation with strict regulatory requirements (e.g., GDPR, PCI-DSS) needs a SIEM solution to monitor its global network. Data residency laws in certain regions prohibit transferring logs outside local jurisdictions. The company also requires centralized monitoring with 24/7 SOC operations but has limited in-house SIEM expertise. Which SIEM deployment model is appropriate in the given scenario?
Cloud, MSSP-Managed
Self-hosted, MSSP-Managed
Self-hosted, Jointly Managed
Hybrid Model, Jointly Managed
Question 28
You are working as a SOC analyst in a multinational company with multiple data centers and remote offices. Security logs are stored locally at each site, making it difficult to correlate incidents across different locations. Recently, an advanced persistent threat (APT) compromised multiple servers, but due to multiple sources of logs and inconsistent monitoring, the attack was detected only after significant data exfiltration had occurred. To improve visibility, streamline log analysis, and enable faster incident response, you need to implement a solution that aggregates logs from all sources into a unified system. Which solution will you implement for your organization?
Local logging
Event tracing
Distributed logging
Centralized logging
Question 29
The Security Operations Center (SOC) team is investigating a suspected malware incident during the Analysis Phase of their incident response process. Their primary goal is to validate the initial detection, ensure the threat is real, and gather critical intelligence to understand the scope of the attack. Which of the following actions should the SOC team take to confirm their initial findings and eliminate false alarms?
Verify generated logs
Scan the enterprise environment and update the scope
Root-cause analysis
Verify false positives
Question 30
Katie is working in the Cyber Security department of an international Financial Corporation INT FIN Corp. as a SOC analyst. She is responsible for monitoring logs to detect potential security threats in real time. Her team needs to implement a functionality as part of incident response plan such that the system that it continuously scans logs for anomalies, identifies suspicious activities, and want to be notified when predefined security thresholds are reached as well as generate incidents or issue tickets to ensure immediate response and mitigation. It must provide critical details such as the type of event, its duration, the affected device, and its OS version. Which function should she configure to achieve this?