2.19 Apply Dashboard Data to Communicate with Technical, Leadership, or Executive Stakeholders 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security analyst is reviewing a dashboard that shows a sudden spike in failed authentication attempts followed by a sharp increase in successful logins from a single IP address. What is the most accurate interpretation of this dashboard data?

   • AA user has forgotten their password and is retrying with the correct credentials.
   • BThe increase in successful logins indicates a successful brute-force attack on an account.
   • CThe successful logins are from a legitimate user who has changed their password.
   • DThe dashboard is displaying a false positive due to a misconfigured logging system.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security director is preparing a presentation for the CEO. The dashboard shows a 30% increase in endpoint detection and response (EDR) alerts, a 20% decrease in the number of endpoints with active malware, and a 15% increase in the use of personal devices (BYOD). The CEO asks, 'Are we more secure than last quarter?' The director knows that the EDR alert increase is partly due to a new detection policy. What is the best way to answer?

   • ASay 'Yes, because active malware is down 20%' and show the EDR alert increase as a sign of better detection.
   • BAvoid giving a direct answer and instead present the raw data for the CEO to interpret.
   • CExplain that the decrease in active malware suggests improved security, but the increase in BYOD introduces new risk, and the EDR alert increase is partly due to the new policy, so the overall posture is mixed.
   • DSay 'No, because EDR alerts are up 30%' and recommend immediate action.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security manager must present to the board of directors after a ransomware incident. The dashboard shows the number of encrypted endpoints, the ransom demand, the cost of downtime, and the percentage of systems restored from backups. Which dashboard presentation best supports the board's need to decide whether to pay the ransom?

   • APresent only the ransom demand and state that the decision is a legal matter, not a security matter.
   • BShow the downtime cost graph and recommend waiting to see if the attackers lower the ransom.
   • CDisplay the ransom demand and the cost of downtime, and recommend paying the ransom to minimize financial loss.
   • DShow the number of encrypted endpoints and the percentage of systems restored from backups, then explain the residual risk and the financial impact of not restoring the remaining systems.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A security engineer is presenting a dashboard to a group of SOC analysts. What is the most appropriate way to present the data?

   • AShow only the top-level summary and let analysts request more details if needed.
   • BPresent only the final recommendations and skip the data to save time.
   • CFocus on business impact and avoid technical specifics to keep the presentation brief.
   • DInclude detailed metrics such as event counts, source IPs, and detection rules used.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is preparing a report for the incident response team about a recent breach. The dashboard shows the timeline of the attack, the tools used, and the affected systems. The team needs to understand the attack path to prevent future occurrences. Which presentation is most effective for this technical audience?

   • AA list of all affected systems with their IP addresses, without any timeline or attack path.
   • BA detailed kill-chain diagram showing each stage of the attack, with the specific tools and affected systems at each stage.
   • CA high-level timeline with only the start and end dates of the breach.
   • DA summary slide that states the breach was contained and no further action is needed.
   Reveal Solution Discussion Select an answer first