2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a lateral movement attack within the network. The analyst has metadata from the authentication system, session data from the firewall, and full packet capture from the internal network. The analyst needs to trace the path of the attacker from one host to another. Which data source would be most useful for this tracing?

   • AMetadata from the authentication system, because it shows user logins
   • BAlert data from the EDR, because it would have detected the lateral movement
   • CSession data, because it shows the connections between hosts
   • DFull packet capture, because it contains the exact commands used
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an incident investigation, an analyst has identified a suspicious file downloaded by a user. The analyst wants to check if this file is known malware by comparing its hash against a threat intelligence feed, without needing to analyze the file's contents. Which data type would provide the necessary information for this comparison?

   • ASession data from the firewall log
   • BMetadata from the file's hash and timestamp
   • CFull packet capture of the download
   • DAlert data from the antivirus console
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a phishing email that contained a malicious attachment. The analyst has the email metadata, including the sender, recipient, subject, and timestamp. The analyst also has full packet capture of the network traffic and transaction data from the email gateway. The analyst needs to determine if the attachment was downloaded by any user and if so, which user. Which data source is most useful for this determination?

   • AFull packet capture, because it contains the attachment content
   • BMetadata from the email gateway, because it includes the recipient and attachment hash
   • CAlert data from the antivirus, because it would detect the malicious attachment
   • DTransaction data from the email gateway, because it shows the email delivery
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is investigating a malware outbreak. They have identified a suspicious file that was downloaded by multiple hosts. The team wants to determine if the file is the same across all hosts and if it matches known malware, without sharing the file content externally. Which combination of data types would best support this investigation?

   • ATransaction data from the web proxy
   • BSession data from the network flow logs
   • CMetadata, such as file hashes, from each host
   • DFull packet capture of the downloads
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator needs to quickly identify which internal hosts are communicating with a known malicious IP address. The company has NetFlow enabled but does not have full packet capture for all traffic. Which data source should the administrator use to get a list of all internal hosts that have communicated with the malicious IP?

   • AStatistical data from the flow aggregator
   • BSession data from the NetFlow collector
   • CTransaction data from the web proxy
   • DFull packet capture of the malicious IP's traffic
   Reveal Solution Discussion Select an answer first