3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SIEM alert fires on a rule that detects 'multiple failed logins followed by a successful login'. The alert includes logs from a web application and the authentication server. Which SIEM feature would allow an analyst to see the full sequence of events across both sources in one view?

   • AA dashboard showing the top 10 source IPs
   • BA correlation search that joins events by username and time window
   • CA raw log export of the authentication server only
   • DA report of all alerts generated in the last 24 hours
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web server log shows the following entry: '192.168.1.50 - - [12/May/2024:10:15:23 +0000] "GET /admin/config.php HTTP/1.1" 200 5120 "http://192.168.1.50/admin/" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"'. The server is not indexed by search engines. Which part of the log entry is the strongest indicator that this request is suspicious?

   • AThe referrer is the /admin/ page
   • BThe response code is 200
   • CThe User-Agent string claims to be Googlebot
   • DThe request method is GET
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst is reviewing a SIEM alert that triggered on a single workstation. The alert is based on a correlation rule that counts failed logons (Event ID 4625) within a 10-minute window. The analyst sees 15 failed logons from the same source IP, followed by one successful logon (Event ID 4624) from the same IP. The user who owns the workstation is on vacation. Which conclusion is most supported by the log evidence?

   • AA brute-force attack succeeded, and the account is compromised
   • BThe user mistyped their password multiple times and then logged in
   • CThe SIEM rule is misconfigured and generated a false positive
   • DA malware infection is causing the workstation to generate logon events
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A log entry shows a user account successfully logging in at 3:00 AM from an IP address in a foreign country, while the user is known to be on vacation. Which type of event does this most likely indicate?

   • AA normal login from a mobile device
   • BA scheduled automated task
   • CA potential unauthorized access
   • DA false positive from the SIEM
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Windows administrator needs to find all PowerShell script executions in the last 24 hours from the security log. The administrator has PowerShell available. Which command will produce the most relevant results?

   • AGet-EventLog -LogName Security -EntryType SuccessAudit
   • BGet-WinEvent -LogName Security -MaxEvents 100
   • CGet-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.Message -like '*powershell*'}
   • DGet-Content C:\Windows\System32\winevt\Logs\Security.evtx
   Reveal Solution Discussion Select an answer first