3.7 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which method is commonly used to centrally collect logs from multiple servers in a scalable way?

   • AEmailing logs to the security team daily
   • BPrinting logs for archival
   • CStoring logs locally on each server and reviewing them manually
   • DForwarding logs to a central syslog server or SIEM
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is examining a suspicious URL from an email: https://www.bank.com.secure-login.example.net/auth?redirect=https://www.bank.com/verify. The analyst needs to identify the actual host that will receive the request. Which component is the host?

   • Aexample.net
   • Bwww.bank.com
   • Cwww.bank.com.secure-login.example.net
   • Dsecure-login.example.net
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A URL reputation service returns 'unrated' for the domain 'example.com'. However, the URL 'http://example.com/redirect?url=http://evil.com' is found in a phishing email. The analyst needs to decide whether to block the URL. What is the best course of action?

   • ABlock the URL because the redirect parameter points to a known malicious domain
   • BBlock the entire domain example.com
   • CAllow the URL because example.com is unrated and not known malicious
   • DIgnore the URL because it is from a phishing email and not a real threat
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to centralize log collection from Windows endpoints, Linux servers, and network firewalls for security monitoring. Which solution best meets this requirement?

   • AConfigure each device to send logs to a shared folder
   • BUse syslog on the firewall and store logs locally
   • CDeploy a SIEM platform and configure all sources to forward logs to it
   • DEnable Windows Event Log forwarding only
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which Windows Event ID is commonly associated with successful user logon events?

   • A4625
   • B4624
   • C7045
   • D4688
   Reveal Solution Discussion Select an answer first