CYBRARY Unit 3 assessment — Detections as evidence
Six questions on placing an alert, reading the checklist and reporting gaps.
6 questions drawn from a bank of 11, in their own order with the options moved. Take it again and you sit a different paper.
0 of 6 answered
1. What makes a detection usable as assessment evidence?
Tests: What counts as evidence
2. What does a gap in the checklist with no detection behind it honestly mean?
Tests: Reading an empty row
3. An alert reads: bulk archive read from the historian, outside the reporting window, to a destination not seen before. Which requirement is it evidence about?
Tests: Matching a finding to a requirement
4. A detection is placed in a zone with the reason 'the asset is on that VLAN'. Is that a sound placement reason?
Tests: Judging a placement reason
5. Two detections cover the same step of an intrusion. What does that give an assessor?
Tests: Corroboration versus duplication
6. A zone's checklist shows a requirement with no graded detection behind it. What is the right report?
Tests: Reporting gaps honestly