2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst receives a large number of alerts every day, many of which are false positives. The analyst wants to reduce the noise by correlating alerts with network flow data to see if the source IP actually communicated with the destination IP. Which data type should the analyst use to verify the alert's validity?

   • AAlert data from the IDS
   • BStatistical data from the traffic analyzer
   • CSession data from the NetFlow collector
   • DFull packet capture of the alert's traffic
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A security analyst wants to establish a baseline of normal network traffic by reviewing aggregated metrics such as packet counts and byte counts over time. Which data type would be most useful for this purpose?

   • AMetadata
   • BStatistical data
   • CFull packet capture
   • DSession data
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center (SOC) wants to establish a baseline of normal network traffic for a new office location. They have been collecting NetFlow data for two weeks and want to identify what is 'normal' so they can tune their alerting. Which data type should they use to build this baseline?

   • ATransaction data from the web proxy
   • BAlert data from the IDS
   • CFull packet capture of all traffic
   • DStatistical data aggregated from the NetFlow records
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices a sudden spike in traffic from a single workstation to many external IP addresses on port 443. The team has no full packet capture enabled, but they do have NetFlow and IDS alerts. Which data source would best help the analyst quickly determine whether this is a normal pattern or a potential command-and-control beacon?

   • AAlert data from the IDS
   • BSession data showing the number of flows, destinations, and duration
   • CStatistical data from the firewall logs
   • DFull packet capture of the workstation's traffic
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations center (SOC) analyst needs to identify which internal hosts are communicating with a known malicious external IP address over the past 24 hours. The analyst does not need to see the content of the communications, only the source and destination IPs, ports, and protocol. Which data source is most appropriate for this task?

   • ATransaction data from an application log
   • BFull packet capture from a network tap
   • CAlert data from the SIEM
   • DSession data from a flow collector
   Reveal Solution Discussion Select an answer first