MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

Which main security requirement does File Integrity Monitoring help achieve in cloud systems?
a. Confidentiality
b. Integrity
c. Availability
d. Scalability
Answer: b. Integritylearn.microsoft+1
Which of the following regulatory standards commonly mandates File Integrity Monitoring for compliance?
a. GDPR
b. PCI DSS
c. NIST SP 800-53
d. ISO 27001
Answer: b. PCI DSSqualys+1
What is the primary function of File Integrity Monitoring?
a. Encrypting files in storage
b. Detecting unauthorized file changes
c. Providing network segmentation
d. Managing user passwords
Answer: b. Detecting unauthorized file changescrowdstrike+1
Which component is NOT typically monitored by FIM solutions?
a. Operating system files
b. Windows registry keys
c. Network switch firmware
d. Application binaries
Answer: c. Network switch firmwarelearn.microsoft
In cloud platforms, which resource does FIM help protect from unauthorized modification?
a. Application logs
b. User endpoint devices
c. Data center HVAC controls
d. Internet bandwidth allocation
Answer: a. Application logsmanageengine+1
Which FIM feature is essential for meeting PCI DSS cloud compliance?
a. Real-time file change alerting
b. Multi-factor authentication
c. Container orchestration
d. Automated backup scheduling
Answer: a. Real-time file change alertingqualys+1
Which is NOT a recommended step in establishing a file integrity monitoring baseline?
a. Define critical files for monitoring
b. Record initial file hashes
c. Allow open access to all files
d. Set up alert thresholds
Answer: c. Allow open access to all filesmanageengine
What is the typical result when FIM detects unauthorized changes on a protected file?
a. Block user login
b. Trigger security alerts
c. Format the storage drive
d. Increase CPU resources
Answer: b. Trigger security alertsqualys+1
Which of the following is NOT a benefit of FIM in the cloud?
a. Compliance enforcement
b. Attack detection
c. Guaranteed data backup
d. Insider threat identification
Answer: c. Guaranteed data backupsysdig+1
Which of the following best describes agent-based FIM solutions?
a. They require no installation
b. They operate via installed software on endpoints
c. They only monitor network traffic
d. They rely on hardware appliances
Answer: b. They operate via installed software on endpointslearn.microsoft
What is the function of hash algorithms in FIM?
a. Encrypt cloud network traffic
b. Generate unique file signatures
c. Compress data for storage
d. Index user accounts
Answer: b. Generate unique file signaturesthreatlocker+1
Which of the following should NOT be included in FIM monitoring scope to avoid noise?
a. Operating system configuration files
b. Temporary log files with frequent changes
c. Application binaries
d. Security policy files
Answer: b. Temporary log files with frequent changeslearn.microsoft
In Microsoft Azure Defender for Cloud FIM, what can be monitored besides files?
a. Disk fragmentation
b. Windows registry keys
c. Network latency
d. Print queues
Answer: b. Windows registry keyslearn.microsoft
Which attack is FIM particularly well-suited to detect?
a. Phishing attacks
b. Unauthorized file tampering
c. Denial of Service
d. Man-in-the-middle attacks
Answer: b. Unauthorized file tamperingcrowdstrike+1
What is a key risk if a cloud environment lacks FIM?
a. Increased file redundancy
b. Undetected configuration changes
c. Faster data transfer
d. Reduced disk usage
Answer: b. Undetected configuration changesqualys+1
Which is NOT considered a type of file change event tracked by FIM?
a. File deletion
b. File copying
c. File modification
d. File attribute change
Answer: b. File copyingqualys+1
What is a drawback of FIM if too many files are monitored?
a. Enhanced threat detection
b. Alert fatigue
c. Improved system logging
d. Automated incident response
Answer: b. Alert fatiguesysdig+1
What does “baseline” refer to in the context of FIM?
a. Maximum allowed users on a system
b. Initial state or signature of monitored files
c. Cloud storage price plan
d. Reserved network bandwidth
Answer: b. Initial state or signature of monitored filesthreatlocker+1
Which is a common FIM deployment mode in cloud-native environments?
a. Virtual appliances
b. Agentless scanning
c. Hardware dongles
d. Fiber channel switches
Answer: b. Agentless scanningaccuknox+1
Which of the following is a popular open-source FIM tool?
a. Qualys Cloud
b. OSSEC
c. AWS CloudTrail
d. Salesforce Shield
Answer: b. OSSECaccuknox
Why is real-time monitoring important in cloud FIM?
a. Ensures high system availability only
b. Allows immediate threat detection and response
c. Optimizes disk space allocation
d. Schedules backups after changes
Answer: b. Allows immediate threat detection and responseaccuknox+1
A good FIM policy should include:
a. All system user accounts
b. A comprehensive list of monitored files and response actions
c. Backup software configuration
d. File compression methods
Answer: b. A comprehensive list of monitored files and response actionsmanageengine+1
Which FIM change type is least likely to indicate a security threat?
a. Modification of operating system kernel
b. Change to user home page HTML
c. Addition of new user within registry
d. Scheduled log file rollover
Answer: d. Scheduled log file rolloverlearn.microsoft
Which major cloud provider has built-in FIM functionality for VMs?
a. Netflix Cloud
b. Azure Defender for Cloud
c. Google Fiber
d. OpenStack Swift
Answer: b. Azure Defender for Cloudlearn.microsoft
If FIM reports a new unknown process modifying critical files, what action should be taken?
a. Ignore alert
b. Investigate and contain potential threat
c. Reboot VM immediately
d. Increase logging only
Answer: b. Investigate and contain potential threatthreatlocker+1
Which validation step does FIM typically perform after file modifications?
a. Compare new file hash to the baseline
b. Delete modified file
c. Duplicate file to backup drive
d. Compress modified files
Answer: a. Compare new file hash to the baselinethreatlocker+1
What is the maximum number of rules allowed in Azure Defender for Cloud FIM?
a. 50
b. 100
c. 500
d. 250
Answer: c. 500learn.microsoft
Which process is critical for successful FIM deployment in cloud environments?
a. Defining a remediation playbook for alerts
b. Partitioning disks for all users
c. Increasing memory allocation
d. Enabling public access for logs
Answer: a. Defining a remediation playbook for alertsmanageengine+1
How does FIM help with insider threat detection in cloud systems?
a. Encrypts insider communications
b. Detects and reports unauthorized file access or change
c. Monitors outgoing emails only
d. Blocks all admin-level logins
Answer: b. Detects and reports unauthorized file access or changesysdig+1
Which is a key difference between agent-based and agentless FIM in the cloud?
a. Agent-based requires endpoint installation, agentless does not
b. Agentless only supports Linux, not Windows
c. Agent-based cannot monitor registry keys
d. Agentless FIM results in data loss
Answer: a. Agent-based requires endpoint installation, agentless does notlearn.microsoft
What should be the primary focus when selecting files or directories for FIM?
a. Files frequently accessed by users
b. Critical system and application files
c. Temporary caches
d. Business marketing resources
Answer: b. Critical system and application filesmanageengine+1
What can excessive FIM-generated alerts indicate?
a. Cloud AC power failure
b. Too many non-critical files are monitored
c. DDoS attack underway
d. Shortage of VM licenses
Answer: b. Too many non-critical files are monitoredsysdig+1
Which FIM configuration step drives compliance in regulated industries?
a. Encrypting all file paths
b. Selecting audit logs and config files for monitoring
c. Installing new operating systems weekly
d. Modifying default firewall rules
Answer: b. Selecting audit logs and config files for monitoringqualys+1
Which cloud threat is FIM best at early detection of?
a. Zero-day virus
b. Unauthorized sensitive file modification
c. Bandwidth bottleneck
d. Hypervisor crash
Answer: b. Unauthorized sensitive file modificationcrowdstrike+1
Which FIM measure helps reduce false positives?
a. Monitor only key file groups and exclude noisy files
b. Monitor every change in the system
c. Ignore event logging
d. Disable change alerting
Answer: a. Monitor only key file groups and exclude noisy filesqualys+1
A FIM tool that offers cloud-native integration for Kubernetes is:
a. Tripwire
b. AccuKnox
c. MySQL
d. WinSCP
Answer: b. AccuKnoxaccuknox
What information does a robust FIM alert provide?
a. Only the file name changed
b. Account, process, source, and event details
c. Timezone configuration
d. File fragmentation status
Answer: b. Account, process, source, and event detailslearn.microsoft
Which approach helps validate FIM effectiveness before production rollout?
a. Testing in virtual environments
b. Enabling only in live systems
c. Ignoring test alerts
d. Postponing until after compliance audits
Answer: a. Testing in virtual environmentsmanageengine
Which critical configuration does FIM in the cloud require?
a. Assigning monitored resources to a Log Analytics workspace
b. Setting default print queues
c. Allocating maximum CPU resources
d. Enabling offline backups only
Answer: a. Assigning monitored resources to a Log Analytics workspacelearn.microsoft
What should be the action if an FIM alert indicates mass deletion of files?
a. Investigate and isolate the event source immediately
b. Wait for scheduled backups to complete
c. Send a newsletter to users
d. Reboot all cloud servers
Answer: a. Investigate and isolate the event source immediatelythreatlocker+1
Which is NOT a supported resource type for custom FIM rules in Azure?
a. Windows registry paths
b. Linux absolute file paths
c. Application configuration files
d. Cloud provider proprietary APIs
Answer: d. Cloud provider proprietary APIslearn.microsoft
What is the maximum depth of allowed wildcard asterisks in FIM rules in Azure?
a. 1
b. 3
c. 5
d. Unlimited
Answer: b. 3learn.microsoft
Why should FIM rule names be unique?
a. For easier identification and management
b. To enable file encryption
c. To trigger antivirus scans
d. To allow duplicate alerts
Answer: a. For easier identification and managementlearn.microsoft
In FIM, “change management and documentation request (CMDR)” refers to:
a. Selecting which file changes matter for compliance/audit tracking
b. Uploading marketing materials
c. Resetting passwords
d. Allocating server licenses
Answer: a. Selecting which file changes matter for compliance/audit trackinglearn.microsoft
What is a recommended response to repeated unauthorized changes detected by FIM?
a. Increase monitoring frequency
b. Review and update security policies and access controls
c. Ignore alerts
d. Remove cloud instance from inventory
Answer: b. Review and update security policies and access controlsthreatlocker+1
How does FIM contribute to the security of cloud application deployments?
a. Detects and reports unauthorized changes to code or config files
b. Compresses application responses for efficiency
c. Provides web hosting for applications
d. Manages DNS entries
Answer: a. Detects and reports unauthorized changes to code or config filesqualys+1
When is it most critical to review FIM alerts?
a. During system maintenance windows
b. When alerts pertain to critical/sensitive files or system binaries
c. Right after lunch breaks
d. When the billing cycle ends
Answer: b. When alerts pertain to critical/sensitive files or system binariesmanageengine+1
Which FIM best practice reduces the risk of insider threat by exploiting privileges?
a. Defining and documenting file access privileges
b. Running FIM as root user only
c. Monitoring cloud billing changes
d. Allowing public cloud folder access
Answer: a. Defining and documenting file access privilegesmanageengine
In hybrid cloud environments, what FIM strategy is most effective?
a. Select tools supporting multi-platform (cloud, on-prem, container)
b. Monitor backup scripts only
c. Focus only on network perimeter defenses
d. Ignore non-virtualized environments
Answer: a. Select tools supporting multi-platform (cloud, on-prem, container)accuknox
What is a primary requirement for FIM rule description fields in Azure Defender for Cloud?
a. Must be under 260 characters with defined characters allowed
b. Must be set to “Active” only
c. Must reference at least two users
d. Is mandatory without exception
Answer: a. Must be under 260 characters with defined characters allowedlearn.microsoft

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info