3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technique is most appropriate for preserving the integrity of digital evidence during a data loss investigation?

   • ACreating a cryptographic hash of the evidence
   • BDeleting duplicate files to save space
   • CCopying the evidence to a shared network drive
   • DOpening the files to verify their contents
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When investigating a database data loss incident, which log source is most useful for identifying unauthorized exports?

   • AEndpoint antivirus logs
   • BDatabase audit logs
   • CFirewall logs
   • DWeb server access logs
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During an endpoint data loss investigation, which log source is most useful for identifying email exfiltration?

   • AFirewall logs
   • BDNS logs
   • CEmail gateway logs
   • DOperating system event logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is investigating a data loss incident that involves multiple vectors: a cloud storage bucket, an endpoint, and a database. The team has collected logs from all three sources, but the logs are in different formats and time zones. The team must determine the scope of the incident and the root cause. Which approach is most effective?

   • AUse the database logs as the primary source because they show the most detailed information.
   • BFocus on the cloud storage bucket because it is the most likely source of the data loss.
   • CNormalize the timestamps to a common time zone and correlate the logs based on user identity and IP address.
   • DInvestigate each vector separately and then combine the findings manually.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which investigation step is most effective for identifying data loss caused by insecure data handling in an application?

   • AChecking the application's source code for hardcoded credentials
   • BReviewing application logs for unusual data access patterns
   • CScanning the application server for malware
   • DReviewing network firewall rules
   Reveal Solution Discussion Select an answer first