Objective 2.1 Analyze Logs for Signs of Attack. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which platform is primarily designed as a security information and event management (SIEM) solution that includes built-in security analytics, file integrity monitoring, and vulnerability detection?

   • ADatadog
   • BELK stack
   • CGraylog
   • DWazuh
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst notices a large number of DNS queries for a domain that resolves to a known malicious IP. Which log source would provide the most direct evidence of this activity?

   • AFirewall logs
   • BDNS server logs
   • CWeb server access logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's SIEM is generating alerts for outbound connections to an IP address that is not on any blocklist. The analyst wants to determine if this IP is known for malicious activity. Which action would provide the most relevant enrichment?

   • AReview the DNS logs for the domain
   • BCheck the firewall logs for the connection
   • CSearch the SIEM for other events from the same IP
   • DQuery a threat intelligence feed for the IP address
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of creating a 'saved search' in a SIEM platform?

   • ATo encrypt the search results
   • BTo automatically block malicious IPs
   • CTo permanently delete old logs
   • DTo store a frequently used query for quick reuse
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC manager wants to quickly identify a spike in failed login attempts across all servers in the last hour. Which dashboard visualization would best serve this purpose?

   • AA table listing all failed login events
   • BA line chart showing total log volume
   • CA pie chart showing the proportion of failed logins by user
   • DA bar chart showing failed login counts per server over time
   Reveal Solution Discussion Select an answer first