Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst notices that a user account that normally logs in from 9 AM to 5 PM local time has successful logins at 3 AM from a foreign IP address. The user is currently on vacation. What should the analyst do?

   • ASend an email to the user to ask if they logged in.
   • BTreat this as a potential account compromise and escalate to the incident response team.
   • CDisable the user account immediately.
   • DIgnore the event because the user might have changed their schedule.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of an indicator of compromise (IoC)?

   • AA user logging in from their usual workstation during business hours
   • BAn unexpected outbound connection to a known malicious IP address
   • CA scheduled backup completing successfully
   • DA user changing their password after a scheduled reminder
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is reviewing logs from multiple sources. The firewall log shows a connection from an internal IP to an external IP on port 443. The web server log shows a successful login to an admin panel from the same internal IP. The authentication log shows that the admin account was locked out after multiple failed attempts, but then a successful login occurred. What is the most likely scenario?

   • AThe admin user forgot their password and reset it.
   • BThe firewall blocked the connection, so the login was not successful.
   • CThe web server log is incorrect because the admin account was locked out.
   • DAn attacker brute-forced the admin password and then logged in successfully.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An application log contains an entry that shows a user inputting a long string with special characters into a search field, and the application returns an error. Which type of attack should the analyst suspect?

   • AMan-in-the-middle
   • BPhishing
   • CSQL injection
   • DDenial-of-service
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is reviewing application logs and finds the following entry: `ERROR: User 'admin' failed to authenticate from IP 10.0.0.5 at 2025-03-14 12:00:00` This is the first of many similar entries from the same IP over the next few minutes. What does this log pattern most likely indicate?

   • AA legitimate user trying to reset their password.
   • BA user repeatedly mistyping their password.
   • CA misconfigured application that is generating false errors.
   • DA brute-force attack against the admin account.
   Reveal Solution Discussion Select an answer first