M20-03Security Monitoring · quiz
Telemetry Correlation
Three alerts arrive during one incident. Correlate the evidence source with the question it can answer and choose the control that limits impact.
1
Which source best records the exact configuration-change message and timestamp from a network device?
2
Which source best summarizes which internal host sent the most traffic to an external destination?
3
Which control can check identity or device posture before granting network access?
4
Which principle says access should be evaluated by identity, context and requested resource instead of trusted location alone?