Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which capability is a defining feature of a SIEM that distinguishes it from a simple log management tool?

   • ACorrelating events across different sources to identify patterns
   • BStoring logs for long-term compliance
   • CGenerating reports for management
   • DProviding a graphical user interface for log viewing
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which scenario best illustrates the use of SOAR in a security operations center?

   • AAn alert triggers a playbook that automatically isolates an infected host and opens a ticket
   • BA SIEM stores logs for six months to meet compliance requirements
   • CA firewall blocks traffic based on signature rules
   • DA security analyst manually reviews logs from multiple systems to identify a breach
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator suspects that a workstation is communicating with a known command-and-control server. The administrator needs to determine whether any other hosts on the network have communicated with the same IP address over the past week. Which data source would be most efficient for this investigation?

   • ANetFlow records from the routers and switches.
   • BWindows Event Logs from each workstation.
   • CFull packet captures from the core switch for the entire week.
   • DSyslog logs from the firewall.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC analyst is handling an alert about a single failed login to a VPN service. The username is a standard user, and the source IP is a known coffee shop IP. The user is a frequent traveler and often connects from public Wi-Fi. The analyst has verified that the user is currently on a business trip. What should the analyst do?

   • AIgnore the alert because the user is a frequent traveler.
   • BDisable the user's VPN account temporarily.
   • CContact the user to verify if they attempted to log in, and monitor for additional failed attempts.
   • DEscalate the alert as a potential brute-force attack.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of a Security Information and Event Management (SIEM) system?

   • ATo aggregate and correlate security event data from multiple sources
   • BTo encrypt data in transit and at rest
   • CTo block malicious traffic at the network perimeter
   • DTo manage user identities and access permissions
   Reveal Solution Discussion Select an answer first