3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC team is investigating a series of alerts. The SIEM shows the following events for a single workstation: 10:00:00 - Failed logon for user 'admin' from IP 203.0.113.5; 10:00:05 - Failed logon for user 'admin' from IP 203.0.113.5; 10:00:10 - Successful logon for user 'admin' from IP 203.0.113.5; 10:00:15 - Process creation: 'cmd.exe' with parent 'winlogon.exe'; 10:00:20 - Process creation: 'powershell.exe' with parent 'cmd.exe'. The organization has a policy that administrative accounts must not be used for interactive logons. The analyst needs to determine if this is a true positive and what the next step should be. Which conclusion is most accurate?

   • AThe logon pattern indicates a brute-force attack that succeeded, and the process creations suggest post-exploitation activity; the analyst should escalate to incident response
   • BThe failed logons are likely due to a mistyped password, and the successful logon is the legitimate user; no action is needed
   • CThe events are unrelated and do not indicate a security incident
   • DThe process creations are normal because the user is an administrator; the analyst should close the alert
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security analyst uses a SIEM platform to detect a brute-force attack. Which SIEM capability is most directly used to identify the attack?

   • AData visualization dashboards
   • BLog retention policies
   • CCorrelation rules
   • DUser access management
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A Windows administrator wants to review security-related events such as successful and failed logon attempts. Which Windows tool should they use?

   • ATask Manager
   • BEvent Viewer
   • CServices console
   • DDevice Manager
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which log component is most important for correlating events across multiple systems in a security investigation?

   • ALog level
   • BSource IP address
   • CTimestamp
   • DMessage text
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is investigating an alert in the SIEM that shows a single workstation making outbound connections to a known malicious IP address. The SIEM also shows that a SOAR playbook automatically blocked the IP on the firewall. The analyst wants to confirm that the block was effective. Which SIEM data should the analyst review?

   • AFirewall logs for subsequent connection attempts from the workstation to the malicious IP
   • BWindows Event Logs for user logons
   • CDNS logs for the malicious domain
   • DSOAR playbook logs for the block action
   Reveal Solution Discussion Select an answer first