GSEC Practice Questions: Defense in Depth Domain

Correct Answer: C

Explanation: C is correct because network segmentation limits the spread of malware by isolating different parts of the network, reducing the impact of a breach. A is incorrect because firewalls are still necessary to control traffic between segments. B is incorrect because segmentation can add complexity to network management. D is incorrect because segmentation does not inherently increase network speed; it focuses on security.

Correct Answer: A

Explanation: Option A is correct because a DLP system helps prevent data exfiltration by insiders by monitoring and controlling data transfer. Option B is important for maintaining system security but does not specifically address insider threats. Option C is useful for detecting unauthorized access but is not specifically designed for insider threats. Option D focuses on external threats, not insiders.

Correct Answer: B

Explanation: Implementing role-based access control (RBAC) is critical for protecting against insider threats as it limits data access to only those who need it for their roles, reducing the risk of data misuse or unauthorized access. Option A, updating firewall rules, protects against external threats but is less effective against insiders. Option C, ensuring up-to-date antivirus software, is important for endpoint protection but does not specifically address insider threats. Option D, conducting vulnerability assessments, helps identify external vulnerabilities but is not directly related to insider threat mitigation.

Correct Answer: B

Explanation: Option B is correct because having an updated contact list ensures that the incident response team can be quickly mobilized during a security incident. Option A is useful for network management but not directly related to incident response. Option C is more relevant to physical security. Option D is related to software management, not incident response.

Correct Answer: B

Explanation: Option B is correct because implementing a VPN enhances network security by encrypting data in transit and securing remote access. Option A relates to access controls, Option C pertains to endpoint security, and Option D is about policy and awareness, not directly about network security.

Correct Answer: C

Explanation: The correct answer is C. A SIEM collects, correlates, and analyzes security data from various sources to detect threats and provide insights into security incidents. Option A describes functions of network monitoring tools or firewalls. Option B is related to patch management systems. Option D is incorrect because SIEMs complement, not replace, firewalls and IDS/IPS.

Correct Answer: B

Explanation: Option B is correct because applying the latest security patch directly addresses the known vulnerability, providing an immediate fix. Option A is useful for detection but does not mitigate the vulnerability. Option C reduces exposure but does not resolve the vulnerability itself. Option D is reactive and does not prevent exploitation.

Correct Answer: C

Explanation: Option C is correct because a SIEM enhances Defense in Depth by enabling timely detection and response, thus adding a layer of monitoring and analysis. Option A is incorrect because focusing on a single point is contrary to the Defense in Depth philosophy. Option B, while a potential benefit, does not directly relate to security. Option D is incorrect as SIEM does not replace the need for individual security controls.

Correct Answer: B

Explanation: Option B is correct as it involves multiple layers of security: a WAF for application-level protection, antivirus for malware detection, and vulnerability scans for identifying weaknesses. Option A is incorrect because it focuses solely on minimizing the attack surface without multiple layers. Option C is incorrect as relying on a single firewall is not a comprehensive strategy. Option D is incorrect because while keeping applications updated is important, it alone does not provide layered defense.

Correct Answer: C

Explanation: A SIEM collects and analyzes log data for threat detection and response, which is its primary role in a defense in depth strategy. It helps identify and respond to potential security incidents by correlating data from various sources. Option A, providing endpoint protection, is incorrect as SIEMs do not block malware. Option B, managing user access, is incorrect as SIEMs do not enforce password policies. Option D, encrypting data, is incorrect as SIEMs focus on log management and analysis rather than data encryption.