Objective 2.1 Analyze Logs for Signs of Attack. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A small company needs a log analysis platform that is free and open-source, with the ability to ingest logs from multiple sources and provide a web interface for searching. Which platform would best meet these requirements?

   • ASplunk
   • BGraylog
   • CDatadog
   • DELK stack (Elasticsearch, Logstash, Kibana)
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An analyst sees an alert for a single failed login on a domain controller. The alert severity is low. However, the analyst notices that the username is 'admin' and the source IP is from a foreign country. Which action should the analyst take first?

   • ADisable the user account immediately
   • BEscalate the alert to high severity and investigate further
   • CChange the alert threshold to reduce noise
   • DIgnore the alert as a single failed login is normal
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A SOC analyst is triaging alerts. Alert A is a single failed login for a standard user. Alert B is a successful login for a domain admin from a new IP address. Alert C is a port scan from an internal IP. Which alert should be prioritized first?

   • AAlert A, because failed logins indicate an attack
   • BAll alerts equally, because they are all security events
   • CAlert C, because port scans are always malicious
   • DAlert B, because it involves a privileged account and a new IP
   Reveal Solution Discussion Select an answer first