Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is reviewing the following security log entry from a web server: `[2025-03-14 12:33:07] 192.168.1.50 - "GET /admin/login.php?user=admin&pass=test123 HTTP/1.1" 200 512` What does this log entry most likely indicate?

   • AA legitimate administrator logging in to the admin panel.
   • BAn attempt to access the admin panel using a SQL injection payload.
   • CA brute-force attack trying multiple passwords for the admin account.
   • DA suspicious request that includes credentials in the URL, indicating a possible credential-harvesting or misconfigured application.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company has deployed a SIEM to collect logs from its firewalls, servers, and endpoints. The security team wants to detect a multi-stage attack that involves a phishing email, a malicious attachment, and subsequent command-and-control traffic. Which SIEM capability is most important for this detection?

   • ACorrelation rules that link events across different log sources and time windows.
   • BAutomated response actions to block malicious IPs.
   • CReal-time log collection from all sources.
   • DLong-term storage of logs for compliance.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst sees a log entry showing that a standard user account successfully logged in to a domain controller at 2 AM. The user is a night-shift employee who normally works from 10 PM to 6 AM. The login originated from the user's usual workstation. What should the analyst do?

   • AIgnore the event because the user is a night-shift employee.
   • BVerify with the user or check if the login is expected, then determine if escalation is needed.
   • CEscalate the event as a potential compromise.
   • DDisable the user's account immediately.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a potential data exfiltration incident. The analyst has access to NetFlow data and full packet captures. Which approach would provide the most comprehensive evidence for the investigation?

   • AUse NetFlow data to identify suspicious flows, then use packet captures to analyze the content of those flows.
   • BUse neither because data exfiltration can only be detected by endpoint logs.
   • CUse only packet captures because they contain the actual data transmitted.
   • DUse only NetFlow data because it provides a summary of all traffic and is easier to analyze.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is monitoring network traffic and observes a large volume of DNS queries for a domain that is only 3 characters long, with a high query rate from multiple internal hosts. The domain is not on any blocklist. What should the analyst do?

   • ADisable DNS on the affected hosts to stop the queries.
   • BIgnore the traffic because the domain is not blocklisted and the queries are legitimate DNS lookups.
   • CEscalate the traffic to the incident response team as a likely indicator of DNS tunneling or malware communication.
   • DBlock the domain immediately to prevent potential malware communication.
   Reveal Solution Discussion Select an answer first