2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A SOC is experiencing a high rate of false positives from its IDS. The team wants to tune the alerting by establishing a baseline of normal traffic patterns. They have access to NetFlow data and IDS alerts. Which approach would be most effective in reducing false positives while maintaining detection capability?

   • AIncrease the sensitivity of the IDS to catch more threats
   • BUse statistical data from NetFlow to identify normal traffic volumes and adjust alert thresholds accordingly
   • CRely solely on session data to identify malicious traffic
   • DDisable all IDS alerts that have a low severity rating
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security analyst wants to review a summary of all network conversations between internal hosts and external servers, including the source and destination IP addresses, ports, and protocol used. Which data type would best provide this information?

   • AStatistical data
   • BFull packet capture
   • CTransaction data
   • DSession data
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   A security analyst needs to enrich the context of a security event with information such as file hashes, timestamps, and source/destination details without storing the full content of the files. Which data type provides this information?

   • AStatistical data
   • BTransaction data
   • CFull packet capture
   • DMetadata
   Reveal Solution Discussion Select an answer first