Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a SIEM that collects logs from multiple sources, but the security team is concerned about the high volume of false positives. They want to improve the accuracy of their alerts without increasing the workload on analysts. Which approach is most effective?

   • AImplement a SOAR platform to automate the triage of alerts and reduce false positives.
   • BIncrease the threshold for all alert rules to reduce the number of alerts.
   • CDisable all alerts that are not related to known critical assets.
   • DUse the SIEM's correlation rules to combine related events and require multiple indicators before generating an alert.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations team wants to automate the response to common incidents, such as phishing emails, but they are concerned about the risk of automated actions causing unintended damage. They decide to implement a SOAR platform. Which configuration best balances automation with safety?

   • ARequire human approval for every action, even low-risk ones, to ensure safety.
   • BUse automated playbooks for low-risk actions and require human approval for high-impact actions.
   • CAutomate all response actions without human intervention to maximize speed.
   • DDisable automation and handle all incidents manually to avoid risk.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing the following security log entry from a Linux server: `Mar 15 02:14:22 server sshd[1234]: Failed password for root from 203.0.113.5 port 54321 ssh2` The same IP has appeared in 50 similar entries in the last 10 minutes. What should the analyst do first?

   • ADisable the root account on the server.
   • BIgnore the entry because failed SSH attempts are common.
   • CBlock the IP address at the firewall immediately.
   • DEscalate the event to the incident response team as a potential brute-force attack.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) receives thousands of alerts daily from its SIEM. Many are low-severity and require repetitive manual actions, such as blocking an IP address or resetting a password. The SOC manager wants to reduce analyst workload while ensuring that high-severity incidents still receive human review. Which approach best meets this requirement?

   • AConfigure the SIEM to automatically close all low-severity alerts without analyst interaction.
   • BHire more analysts to manually review every alert.
   • CIncrease the SIEM's alert threshold so that only high-severity alerts are generated.
   • DImplement a SOAR platform to automate response actions for predefined low-severity playbooks, while routing high-severity alerts to human analysts.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small company uses a SIEM to collect logs from its firewall, domain controller, and antivirus console. The SIEM generates an alert when a single workstation fails authentication five times within one minute. The security analyst notices that this alert fires frequently for a specific user who often mistypes passwords. The analyst wants to reduce noise while still detecting a potential brute-force attack. What should the analyst do?

   • AModify the correlation rule to require failed attempts from multiple source IPs or a higher count over a longer window, and exclude the known user only if the pattern matches their typical behavior.
   • BIncrease the alert threshold to 20 failed attempts within one minute.
   • CCreate a correlation rule that triggers only when failed attempts occur across multiple source IP addresses for the same account.
   • DSuppress alerts for that specific user account because the behavior is known to be benign.
   Reveal Solution Discussion Select an answer first