Mitigation Techniques and Controls

You have been directed by upper management to block employees from accessing Facebook from the corporate machines. Which would be the easiest way to exercise this control?

• Application allow list

• Application block list

• DLP

• Content filtering

Having an expired certificate is an example of what type of error?

• Mobile device management

• Configuration

• Application whitelisting

• Content filter/URL filter

A system-focused set of predetermined automation steps is an example of what?

• Isolation

• Runbook

• Playbook

• Firewall rules

Your business application server sends data to partners using encrypted (signed) messages. You hear from one of the partners that their messages have ceased coming. What should you investigate?

• Application whitelist

• Application blacklist

• The playbook for the system

• Configuration settings of the process

You have kiosk-based machines in the lobby and scattered through the facility. They do not require a login for guests to access certain items. What is the best way to protect these machines from users introducing trojans?

• Application allow list

• Application block list

• Data loss prevention

• Configuration settings of the process

To coordinate team activities during an incident response event, what is the best way to communicate approved instructions?

• Runbook

• MDM solution

• Quarantine rule

• Playbook

Your security system has identified a specific executable as potentially dangerous. What is the best way to handle the specific item that was identified?

• Segmentation

• Quarantine

• Firewall rule

• Playbook

Your company has merged with another company, and it uses a different release of accounting software than your company does. How could you provision user machines in accounting so they will not inadvertently run the incorrect version?

• Application allowlisting

• Isolation

• Configurations associated with the application

• Application block listing

You wish to keep people from using the internal mobile network to play games on their personal phones. What would be the best method of managing this?

• MDM

• Application block list

• Content filter

• Segmentation

What is the primary purpose of a SOAR solution?

• To collect and aggregate diverse security data

• To analyze data for anomalies and to create alerts

• To produce approved, detailed response plans with respect to given incident response scenarios

• To manage configuration changes on systems