Monitor Security Events and Know When Escalation Is Required 100-160 Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   A security analyst notices a server sending a large amount of data to an external IP address at 3:00 AM, which is unusual for that server. What should the analyst flag this as?

   • AA configuration change
   • BNormal maintenance
   • CA false positive
   • DAnomalous behavior
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What type of network data summarizes traffic flows by recording metadata such as source and destination IPs, ports, and byte counts?

   • AWindows event logs
   • BDNS logs
   • CNetFlow
   • DPacket capture (PCAP)
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A security operations team is overwhelmed by the number of low-severity alerts. They want to automate the initial response to these alerts, such as isolating an infected endpoint, but they also want to ensure that a human approves any action that could affect business operations. Which approach best meets this requirement?

   • AUse the SOAR platform to run automated enrichment and triage, but require human approval for containment actions.
   • BIncrease the severity threshold so that more alerts are considered low-severity and require less attention.
   • CDisable all low-severity alerts to reduce the workload.
   • DConfigure the SOAR platform to automatically isolate any endpoint that triggers a low-severity alert.
   Reveal Solution Discussion Select an answer first