2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security analyst needs to review the specific HTTP requests made by a user, including the URLs and methods used. Which data type would provide this application-layer detail?

   • ASession data
   • BFull packet capture
   • CStatistical data
   • DTransaction data
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is investigating a malware infection that occurred two weeks ago. The IDS alert only shows the signature and timestamp, and the NetFlow data shows the connection details. To perform a deep forensic analysis of the malware's command-and-control traffic, which data source would be most valuable if it was available?

   • AFull packet capture from the time of the infection
   • BAlert data from the IDS
   • CSession data from the NetFlow collector
   • DMetadata from the endpoint logs
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A web application firewall (WAF) generated an alert for a suspicious HTTP request to a login page. The analyst needs to see the exact URL, HTTP method, and user-agent of the request to determine if it was an attack or a false positive. Which data type provides this level of application-layer detail?

   • ATransaction data from the WAF logs
   • BStatistical data from the traffic analyzer
   • CMetadata from the proxy logs
   • DSession data from the network flow logs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst is triaging a large number of notifications from various security tools. The analyst needs to prioritize which notifications to investigate first based on the severity and potential impact. Which data type provides the severity and signature information needed for triage?

   • ASession data from the flow collector
   • BStatistical data from the performance monitor
   • CAlert data from the SIEM
   • DMetadata from the file system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a suspected data exfiltration incident. The security team has NetFlow records showing a large transfer from an internal host to an external IP, and the IDS generated a high-severity alert for the same time window. To confirm whether sensitive data actually left the network, which data source should the analyst consult?

   • AAlert data from the IDS
   • BSession data from the NetFlow collector
   • CStatistical data from the flow aggregator
   • DFull packet capture of the session
   Reveal Solution Discussion Select an answer first