3.5 Interpret Operating System, SIEM, SOAR Platform, Application, or Command Line Logs to Identify an Event 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A Linux analyst wants to extract only the lines from a log file that contain the word "ERROR". Which command-line tool is most appropriate?

   • Agrep
   • Bawk
   • Ccut
   • Dsed
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An application log shows repeated entries: 'ERROR: Connection timeout to database' every 5 seconds for 10 minutes, followed by 'INFO: Connection restored'. Which event does this log pattern most likely indicate?

   • AA SQL injection attack
   • BA normal maintenance window
   • CA database server outage
   • DA brute-force attack on the application
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOAR platform log shows that a playbook ran and executed the action 'Block IP' on a firewall. The log entry includes the trigger: 'SIEM alert: Malware C2 beacon detected'. Which SOAR log field would be most important to verify that the correct IP was blocked?

   • AThe timestamp of the playbook execution
   • BThe action parameters, including the IP address
   • CThe playbook name
   • DThe username of the analyst who created the playbook
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC analyst is reviewing SOAR logs after a playbook ran automatically. The playbook was triggered by a SIEM alert for 'possible malware beaconing'. The playbook actions were: 1) Query the endpoint for running processes, 2) Check the process hash against a threat intelligence feed, 3) If malicious, quarantine the endpoint. The SOAR log shows that the process hash was not found in the threat intelligence feed, so the playbook did not quarantine the endpoint. However, the analyst later determines that the process is indeed malicious based on other indicators. What is the most significant limitation of the playbook?

   • AThe playbook relies solely on hash-based detection, which can miss unknown or zero-day malware
   • BThe playbook did not create a ticket for the incident
   • CThe playbook did not query the endpoint for running processes
   • DThe playbook was triggered by a false positive alert
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOAR platform log shows that a playbook automatically quarantined a workstation after a SIEM alert. The playbook log entry includes: 'Trigger: SIEM alert ID 12345', 'Action: Isolate host', 'Status: Success'. Which additional piece of information in the SOAR log would be most useful for a SOC analyst to determine if the action was appropriate?

   • AThe time the playbook was last updated
   • BThe name of the analyst who approved the playbook
   • CThe version of the playbook that was executed
   • DThe raw SIEM alert data that triggered the playbook
   Reveal Solution Discussion Select an answer first