300-215 Question 141
Select 3An organization has detected unusual behavior on its network and suspects a zero-day exploitation targeting a critical application. As part of the incident response process, you are tasked with recommending a strategy to predict and mitigate similar vulnerabilities in the future. How should the organization leverage SIEM data collection and AI-based predictive vulnerability management effectively?
- A
Use SIEM to collect and normalize logs from all endpoints and network devices to identify potential exploit patterns.
- B
Deploy AI-based models to analyze historical SIEM data and predict vulnerabilities based on observed attack trends.
- C
Disable all unpatched systems immediately to prevent further exploitation of zero-day vulnerabilities.
- D
Incorporate risk assessment frameworks to prioritize remediation for vulnerabilities with the highest potential impact.
- E
Rely on AI-based tools exclusively for zero-day detection, removing the need for manual analysis.
Show answer and explanation
Correct answers: A, B, D
Explanation
Effectively responding to zero-day exploits requires a combination of SIEM data collection, AI-based predictive tools, and established risk assessment frameworks. SIEM provides the necessary data for analysis, while AI processes this data to detect trends and predict potential vulnerabilities. Risk assessment frameworks prioritize mitigation efforts, ensuring resources are allocated to address the most critical threats. Together, these strategies enable organizations to improve their resilience against zero-day exploits.
- A. Correct.
Using SIEM to collect and normalize logs allows the organization to centralize data and detect patterns indicative of zero-day exploits, making it an essential step in the forensic and predictive process.
- B. Correct.
AI-based models can process large datasets from SIEM to identify trends and predict which vulnerabilities are likely to be exploited, enabling proactive defense measures.
- C. Incorrect.
Disabling all unpatched systems is not always practical or effective for zero-day vulnerabilities, as it could disrupt critical operations and doesn't address the underlying risk assessment.
- D. Correct.
Risk assessment frameworks help organizations focus on addressing vulnerabilities that pose the greatest risk, ensuring resources are allocated effectively and efficiently.
- E. Incorrect.
Relying solely on AI-based tools without manual analysis introduces risks, as human expertise is often needed to validate findings and address nuanced threats.