May 2021

Article

Preparing for your next security certification exam? After trying your hand at this practice test question, join the FREE CertMike Study Group for the CISSP, Security+, CySA+, PenTest+, CISM+ or SSCP certification to receive new questions each week. You’ll also receive free access to my customized study strategies. Susan is looking for a security solution that is capable of reacting automatically to security information and performing a variety of tasks across other security solutions. Which one of the following technologies would best meet her needs? A. CASB B. SIEM C. SOAR D. IPS Correct Answer: C Security orchestration, automation, and response (SOAR) platforms are specifically designed to react to security information and perform workflows across a variety of other systems, which would make it the best choice. Security information and event management (SIEM) platforms are capable of doing this to some degree, but they are not as well suited to the task as SOAR platforms, so while SIEM might be a good answer, it’s not the best possible answer. When you take a security certification exam, it’s very important to remember that questions may have one or more possible answers. You always want to choose the best of those choices. That’s why it’s very important to read the entire question carefully! Cloud access security brokers (CASB) and intrusion prevention systems (IPS) are not designed for correlating and responding to security information. CASB systems enforce security policies across cloud environments while an IPS is designed to detect and block intrusions. Interested in more practice test questions? Get a copy of my official CertMike Practice Test books for the Security+ exam, CISSP exam, SSCP exam, or CySA+ exam and practice with hundreds of questions designed just like the real test! ...

Preparing for your next security certification exam? After trying your hand at this practice test question, join the FREE CertMike Study Group for the CISSP, Security+, CySA+, PenTest+, CISM+ or SSCP certification to receive new questions each week. You’ll also receive free access to my customized study strategies. Alex is reviewing alerts generated by his organization's SIEM and determines that the SIEM is generating too many false positive alerts. What parameter can he alter to reduce the number of false positives? A. Reduce the SIEM sensitivity B. Increase the SIEM sensitivity C. Reduce the SIEM capacity D. Increase the SIEM capacity Correct Answer: A To alter the false positive rate, Alex should adjust the SIEM sensitivity. Increasing the sensitivity of the SIEM reduces the threshold for an alert and would increase the number of false positives. Decreasing the sensitivity of the SIEM would increase the threshold for an alert and decrease the number of false positives. Adjusting the SIEM capacity would adjust the amount of information that it can process and store, rather than changing the false positive rate. Interested in more practice test questions? Get a copy of my official CertMike Practice Test books for the Security+ exam, CISSP exam, SSCP exam, or CySA+ exam and practice with hundreds of questions designed just like the real test! ...