2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of data normalization in security data management?

   • ATo encrypt sensitive security data at rest
   • BTo delete duplicate security events automatically
   • CTo convert data into a common format for correlation and analysis
   • DTo reduce the storage size of security logs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC manager wants to provide a dashboard that shows the number of alerts by severity, the top attacked assets, and the trend of phishing emails over the past month. The data is already collected in the SIEM. What should the manager use to present this information effectively?

   • AExport the raw logs to a spreadsheet for manual analysis
   • BCreate visualizations and dashboards in the SIEM that aggregate and display the data
   • CIncrease the log retention period to ensure more data is available
   • DEnable additional data sources to collect more information
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of data enrichment in security analysis?

   • ATo add contextual information, such as threat intelligence, to raw security data
   • BTo convert security data into a common format
   • CTo reduce the volume of security data by removing irrelevant events
   • DTo encrypt security data for secure transmission
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which analytical technique is commonly used to identify unusual behavior in security data?

   • AData deletion
   • BAnomaly detection
   • CData encryption
   • DData compression
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A healthcare organization must retain patient data logs for six years per regulations, but internal policy requires that logs containing personally identifiable information (PII) be deleted after three years. The SIEM currently stores all logs for six years. The compliance officer wants to resolve this conflict. What should the organization do?

   • ASeparate PII-containing logs from non-PII logs and apply different retention periods: three years for PII and six years for non-PII
   • BDelete all logs after three years to comply with the internal policy
   • CAnonymize all logs after three years and retain them for six years
   • DRetain all logs for six years and rely on the regulation taking precedence
   Reveal Solution Discussion Select an answer first