3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SIEM analyst sees an alert for 'Multiple failed logins' for a user account. The SIEM shows 50 failed logins from a single IP over 10 minutes, then a successful login from the same IP. Which additional data point would most strongly indicate a successful brute-force attack rather than a user forgetting their password?

   • AThe successful login was followed by a change to the user's password
   • BThe failed logins occurred during business hours
   • CThe failed logins used different usernames
   • DThe successful login occurred after the failed attempts
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Windows administrator wants to search the Security event log for events with Event ID 4625 (failed logon). Which PowerShell cmdlet is most appropriate?

   • AGet-Content
   • BGet-WinEvent
   • CGet-Process
   • DGet-Service
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security analyst reviews a SOAR platform's log and sees an entry that says "Playbook 'BlockMaliciousIP' executed action 'block_ip' on firewall." What does this log entry primarily indicate?

   • AAn automated response action was taken
   • BA user manually blocked an IP address
   • CA new firewall rule was created by the network team
   • DA vulnerability scan was completed
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which log pattern is most commonly associated with a distributed denial-of-service (DDoS) attack?

   • AAn unusual spike in outbound data from a single host
   • BA single source IP repeatedly failing authentication
   • CA large volume of incoming traffic from many different source IPs
   • DA few requests to a sensitive file
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A web server access log contains the following entry: '192.168.1.10 - - [10/Oct/2023:13:45:22 +0000] "GET /admin/config.php HTTP/1.1" 200 512'. The source IP is an internal workstation that has never accessed this resource before. Which event does this log entry most likely indicate?

   • AA denial-of-service attack
   • BA web crawler indexing the site
   • CAn attempt to access a restricted administrative resource
   • DA normal internal user accessing a public resource
   Reveal Solution Discussion Select an answer first