CRISC Question 311

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Out of the given options, the BEST control to detect an APT is implementing automated log monitoring (Option D). Implementing automated log monitoring: Automated log monitoring is the BEST control for detecting an APT. APT attacks are designed to remain undetected for long periods, and they often leave subtle signs of their presence in the network logs. Automated log monitoring can help identify these signs by analyzing network logs for unusual patterns of activity or behavior. It can also help identify insider threats and detect data exfiltration attempts. In summary, while all the given options can help strengthen the security posture of an organization, the best control to detect an APT is implementing automated log monitoring.

• Chose D1

  D. Implementing automated log monitoring. The best control to detect an advanced persistent threat (APT) is to implement automated log monitoring. Advanced persistent threats are sophisticated and often stealthy attacks that aim to maintain a persistent presence within a network over an extended period of time. These attacks can be challenging to detect using traditional security measures alone. Automated log monitoring involves continuously analyzing and correlating system logs, network traffic, and other relevant data sources for unusual or suspicious activities. This control can help identify indicators of compromise, abnormal behavior, or patterns consistent with APTs, making it an effective measure for early detection and response.

• Chose D1

  Between "C" and "D" going with "D", SIEM can detect some signs of APT attacks Antivirus/FW could detect some types but they are not designed to do so