2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team wants to detect lateral movement within the network. They plan to analyze communication patterns between internal hosts. Which security data source would be most useful for this analysis?

   • AVulnerability scan reports that list system weaknesses
   • BDNS logs that show domain name resolution requests
   • CNetwork flow records that show connections between internal IP addresses
   • DAuthentication logs that show successful and failed logins
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational company stores security logs in a SIEM hosted in a public cloud. The logs contain personal data of EU citizens. The company's legal team requires that the data remain within the EU to comply with data residency regulations. What should the company do?

   • AAnonymize the logs before storing them in the cloud
   • BStore the logs on-premises in the company's headquarters outside the EU
   • CConfigure the SIEM to use a cloud region located within the EU
   • DEncrypt the logs and store them in any cloud region
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst notices a single failed login event from an internal IP address in the VPN logs. To determine if this is part of a broader attack, the analyst wants to see if the same IP address attempted logins on other systems or triggered any alerts. Which action would best support this investigation?

   • ANormalize the VPN log to a standard format for future analysis
   • BEnrich the VPN log with threat intelligence to check if the IP is malicious
   • CIncrease the retention period for VPN logs to preserve evidence
   • DCorrelate the VPN log with authentication logs from other systems and endpoint alerts using the source IP address
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SIEM receives logs from multiple sources where timestamps are in different formats and time zones. The analyst wants to correlate events that occurred at the same time. What should the SIEM do to enable accurate correlation?

   • AManually adjust timestamps during investigation.
   • BNormalize all timestamps to a common time zone and format, such as UTC ISO 8601.
   • CStore the logs with their original timestamps and time zones.
   • DUse the SIEM's ingestion time as the event time.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is the archival stage important in the security data lifecycle?

   • AIt encrypts data for the first time
   • BIt converts data into a human-readable format
   • CIt immediately deletes all data to reduce storage costs
   • DIt allows data to be retained for long-term compliance and forensic needs
   Reveal Solution Discussion Select an answer first