Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which factor is most important when determining whether a security event should be escalated to higher-level personnel?

   • AThe potential impact on critical systems and data
   • BThe number of users affected
   • CThe time of day the event occurred
   • DThe skill level of the analyst who detected the event
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary function of a Security Orchestration, Automation, and Response (SOAR) platform?

   • ATo automate and orchestrate incident response workflows
   • BTo provide a central repository for threat intelligence feeds
   • CTo perform deep packet inspection on network traffic
   • DTo replace the need for a SIEM in security operations
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security analyst detects a single failed login attempt on a user account. According to typical escalation criteria, what should the analyst do?

   • ADisable the user account immediately
   • BDocument the event and continue monitoring for additional failures
   • CIgnore the event completely
   • DImmediately escalate to the incident response team
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which type of network data provides a detailed record of the actual content of traffic, including payloads?

   • ASNMP traps
   • BSyslog
   • CPacket capture (PCAP)
   • DNetFlow
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SIEM alert triggers when a single host performs a port scan of more than 100 ports on another host within a minute. The alert fires frequently for a vulnerability scanner that runs weekly. The security team wants to continue detecting real port scans but reduce false positives. What should the team do?

   • AAdd the vulnerability scanner's IP address to an allowlist in the SIEM rule.
   • BIncrease the threshold to 500 ports per minute.
   • CIgnore the alerts from the scanner because they are expected.
   • DDisable the alert rule entirely.
   Reveal Solution Discussion Select an answer first