Domain 3.0
Mike Chapple, David Seidl · 2020
This chapter presents multiple choice questions related to security operations and monitoring. The exam objectives covered by the multiple choice questions are how to analyze data as part of security monitoring activities, including heuristics, trend analysis, impact analysis, security information and event management (SIEM) review, and query writing. The questions also cover concepts related to implementation of configuration changes to existing controls to improve security, including firewall, data loss prevention, endpoint detection and response, and network access control. The exam objectives also cover the importance of proactive threat hunting, as well as how to compare and contrast automation concepts and technologies, including application programming interface integration, automated malware signature creation, and data enrichment.