1.9 Identify Potential Data Loss from Traffic Profiles 200-201 Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A security analyst at a financial firm notices that a finance workstation has been sending large volumes of data to a cloud storage service during off-hours over the past week. The baseline shows that this workstation normally sends less than 50 MB per day to any external service. Which action should the analyst take first to confirm whether this is a data loss event?

   • ACompare the destination IPs and file types in the traffic against the organization's approved cloud services list
   • BBlock the cloud storage service at the firewall immediately
   • CDisable the workstation's network access until the user is interviewed
   • DSearch the workstation's local event logs for user login times
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is investigating a potential data breach. The analyst notices that a server with sensitive customer data has been sending small, frequent DNS queries to a domain that is not on the organization's approved list. The queries contain encoded data. What should the analyst do to confirm whether data loss is occurring?

   • ABlock the domain immediately and assume data loss occurred.
   • BCheck if the domain is used by any legitimate service in the organization.
   • CIgnore the DNS queries because they are small and unlikely to cause significant data loss.
   • DCorrelate the DNS queries with the server's baseline and other logs to determine if the encoded data matches sensitive data.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A security analyst observes a spike in outbound HTTPS traffic from a database server to a file-sharing website during non-business hours. The server normally has no outbound traffic. The analyst also sees that the server's local logs show a large number of failed login attempts earlier that day. Which conclusion is most supported by correlating these observations?

   • AThe failed logins and outbound traffic are unrelated and the spike is likely a false positive
   • BThe server was compromised and data may have been exfiltrated to the file-sharing site
   • CThe server is running a scheduled backup that uploads to the cloud
   • DThe outbound traffic is due to a software update from the vendor
   Reveal Solution Discussion Select an answer first