2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst needs to perform a deep forensic investigation of a network breach that occurred three days ago. Which data type would provide the most complete evidence for reconstructing the exact sequence of packets exchanged during the incident?

   • AStatistical data
   • BSession data
   • CAlert data
   • DFull packet capture
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of metadata in a security monitoring context?

   • AThe aggregated byte count of all traffic
   • BThe SHA-256 hash of a suspicious file
   • CThe raw bytes of a network packet
   • DThe full content of an email message
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security analyst receives a notification from an intrusion detection system that includes a severity level, a signature name, and associated event details. Which data type does this notification represent?

   • ASession data
   • BAlert data
   • CMetadata
   • DStatistical data
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an incident investigation, an analyst finds a suspicious file downloaded from an email attachment. The analyst wants to check if this file is known malware by comparing its hash against a threat intelligence feed, without uploading the file to an external service. Which data type would provide the necessary information for this comparison?

   • ATransaction data from the email gateway
   • BMetadata, specifically the file hash
   • CFull packet capture of the download
   • DAlert data from the antivirus
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC is overwhelmed by the volume of alerts and is considering implementing a risk-based alert prioritization system. The team has access to IDS alerts, NetFlow data, and vulnerability scan results. Which approach would most effectively reduce alert fatigue while ensuring critical threats are addressed?

   • AIncrease the severity threshold for all alerts to reduce the number of alerts
   • BAutomatically close all alerts that do not have a corresponding NetFlow session
   • CUse statistical data to suppress alerts during peak traffic hours
   • DCorrelate alert data with session data and vulnerability information to prioritize alerts based on asset criticality and exploitability
   Reveal Solution Discussion Select an answer first