Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network security team is investigating a possible malware infection. They have NetFlow data showing a host communicating with a known malicious IP. They also have full packet captures from the same period. The team wants to determine if the host downloaded a specific malware payload. Which data source should they analyze first?

   • AFull packet captures to inspect the content of the traffic.
   • BDNS logs to see if the host resolved the malicious domain.
   • CFirewall logs to see if the connection was allowed.
   • DNetFlow data to confirm the communication pattern.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has deployed a SIEM to collect logs from firewalls, servers, and applications. The security team wants to detect a multi-stage attack that involves a phishing email, a malicious download, and lateral movement. What is the primary benefit of using a SIEM for this detection?

   • AIt provides a single console for manually reviewing all logs.
   • BIt replaces the need for endpoint protection software.
   • CIt automatically blocks malicious traffic at the firewall.
   • DIt correlates events from different sources to identify the attack chain.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network analyst is investigating a potential data exfiltration incident. The analyst has access to NetFlow data and full packet captures. Which combination of data sources would provide the most comprehensive evidence for the investigation?

   • ANetFlow data only, because it shows the volume and flow of traffic.
   • BBoth NetFlow and full packet captures, because NetFlow identifies the flows and packet captures reveal the content.
   • CNeither, because data exfiltration can only be detected by endpoint logs.
   • DFull packet captures only, because they contain the actual data transmitted.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst receives an alert from the SIEM indicating that a single workstation has been sending large amounts of data to an external IP address that is not on any threat intelligence list. The workstation is used by a marketing employee who frequently uploads large files to a vendor's cloud service. What should the analyst do?

   • ABlock the external IP address at the firewall.
   • BSuppress the alert because the user frequently uploads large files.
   • CCheck the destination IP against threat intelligence and verify with the user or their manager whether the upload is expected.
   • DEscalate the alert to the incident response team immediately.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small company's SIEM shows a single failed login event for a user account, followed by a successful login from the same IP address 30 seconds later. The user is currently online and reports no issues. The SOC analyst notices this pattern repeated for three other accounts from the same IP within the hour. According to the escalation criteria, what should the analyst do next?

   • AIgnore the events because each account had only one failed login, which is below the threshold for suspicious activity.
   • BEscalate immediately to incident response because multiple accounts from one IP indicate a brute-force attack.
   • CCorrelate the events with other data, such as geolocation or time of day, and then escalate if the pattern appears malicious.
   • DDisable the user accounts immediately to prevent further unauthorized access.
   Reveal Solution Discussion Select an answer first