D340 Cyber Defense and Countermeasures - Set 3 - Part 3

Correct Answer: Provider audit logging not being enabled or retained

Cloud audit logging often requires explicit enablement and retention configuration. Without it, the record of administrative actions simply does not exist.

Correct Answer: Detecting unauthorized changes to critical files and configurations

FIM alerts when protected system files, binaries, or configurations change unexpectedly, revealing tampering, backdoors, or unauthorized modification.

Correct Answer: Identifying activity that deviates significantly from established normal patterns

Anomaly detection flags statistically unusual behavior, capable of surfacing novel attacks that no signature describes, at the cost of more false positives.

Correct Answer: Signatures are precise but miss novel threats; anomalies catch novelty but create noise

Signatures reliably identify known threats with few false positives but miss anything new. Anomaly detection can find novel attacks but requires tuning to control noise.

Correct Answer: They cover complementary detection gaps

Combining precise signature detection for known threats with behavioral detection for novel activity provides broader coverage than either alone.

Correct Answer: Future analysts understand intent, coverage, and limitations

Documented rationale explains what a rule targets, its known blind spots, and expected false positives, making the detection maintainable as environments change.

Correct Answer: The adversary behaviors relevant to the organization's threat model

Coverage is meaningful only relative to the techniques adversaries actually use against the organization, not raw alert volume or tool count.

Correct Answer: Environments change and adversaries adapt their techniques

As systems, applications, and attacker techniques evolve, existing rules silently stop matching relevant activity, so detections require ongoing review and revision.

Correct Answer: Defining a specific threat scenario and how it will be detected

A use case links a specific threat scenario to required data sources and detection logic, ensuring monitoring is driven by threats rather than available data alone.

Correct Answer: Continuously testing detections against realistic attacker behavior and closing gaps

Sustained improvement comes from validating detections against realistic techniques, identifying what would go unnoticed, and systematically closing those gaps.