2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst needs to review the historical record of authentication attempts and system events across multiple servers. Which type of security data source would provide this information?

   • ASystem and application logs
   • BSecurity alerts
   • CNetwork flow records
   • DPacket captures
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A security analyst sees an alert for an outbound connection to an IP address. Which enrichment would be most useful to quickly determine if this IP is known to be malicious?

   • AConfiguration management lookup
   • BUser identity lookup
   • CAsset inventory lookup
   • DThreat intelligence lookup
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst needs to capture the full content of network traffic for a specific application to troubleshoot a potential data exfiltration incident. The analyst needs to see the actual payloads, not just connection metadata. Which data collection method should be used?

   • ANetFlow export from the router
   • BAPI-based collection from the firewall
   • CPacket capture on the network segment where the application traffic flows
   • DSyslog forwarding from the application server
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A multinational company stores security logs that contain personal data of EU citizens. The company uses a SIEM hosted in a US data center. To comply with GDPR, what must the company ensure?

   • AThe company must obtain consent from each EU citizen before storing logs.
   • BAll security logs must be stored only within the EU.
   • CThe logs must be anonymized before storage.
   • DThe data transfer to the US must have an appropriate legal mechanism, such as Standard Contractual Clauses.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is investigating a potential data exfiltration. The SIEM shows a large outbound transfer from a server to an external IP. The analyst wants to confirm if the external IP is known for data exfiltration and if the server's user account has a history of unusual activity. Which two data sources should be correlated?

   • AThreat intelligence feeds and authentication logs
   • BNetFlow and packet captures only
   • CEDR alerts and vulnerability scan results
   • DFirewall logs and DNS logs only
   Reveal Solution Discussion Select an answer first