Objective 2.1 Analyze Logs for Signs of Attack. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a log-analysis platform, what is the purpose of applying a filter to a log search?

   • ATo permanently delete irrelevant logs
   • BTo automatically generate reports for management
   • CTo isolate relevant log entries from large datasets
   • DTo encrypt log data at rest
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which search syntax is commonly used in SIEM platforms like Splunk to find log entries containing the word 'failed' and the IP address '192.168.1.100'?

   • Afailed AND 192.168.1.100
   • Bfailed XOR 192.168.1.100
   • Cfailed NOT 192.168.1.100
   • Dfailed OR 192.168.1.100
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of integrating threat intelligence feeds into a SIEM?

   • ATo automatically patch vulnerabilities on endpoints
   • BTo replace the need for log analysis
   • CTo encrypt all log data
   • DTo enrich log analysis with known indicators of compromise (IOCs)
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which log pattern is a strong indicator of a potential data exfiltration attempt?

   • AA system log showing a scheduled backup
   • BA web-server log showing a 200 OK response
   • CA user logging in during normal business hours
   • DA large outbound data transfer from an internal server to an external IP during off-hours
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC team is overwhelmed by alerts for failed logins from a single IP that is actually a legitimate vulnerability scanner. They want to reduce noise without missing real attacks. Which approach is most effective?

   • AIgnore all failed login alerts
   • BCreate a suppression rule for the scanner's IP address
   • CIncrease the alert threshold for all failed logins
   • DDisable logging for the scanner's IP
   Reveal Solution Discussion Select an answer first