3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A database administrator discovers that a table containing customer PII was exported to a CSV file, but no one in the organization admits to performing the export. The database audit logs show a series of SQL queries that appear to be injection attempts. Which investigation step is most appropriate to determine whether the export was caused by SQL injection?

   • ACorrelate the database audit logs with the web application logs to identify the source IP addresses and the exact queries sent to the database.
   • BRestore the database from a backup taken before the export to remove any injected data.
   • CCheck the database server's file system for the CSV file and preserve it as evidence.
   • DReview the database administrator's account activity to see if they performed the export.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A file server has a shared folder that was accidentally configured with 'Everyone' full control. An investigator needs to determine if any data was actually accessed by unauthorized users. Which log source would provide the most direct evidence?

   • AThe server's performance monitor logs.
   • BFile system audit logs that record successful access events to the shared folder.
   • CServer event logs for failed logon attempts.
   • DNetwork firewall logs for connections to the server.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An endpoint detection and response (EDR) alert shows that a user copied a large number of files to a removable drive. The user claims they were backing up their work. The security team needs to determine whether the files were sensitive. Which data source should the investigator examine?

   • AThe user's calendar to see if they had a meeting that required the files.
   • BThe EDR telemetry that records the file names and paths of the files copied to the removable drive.
   • CThe user's browser history to see if they uploaded the files to a cloud storage service.
   • DThe user's email logs to see if they sent the files to a personal account.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A database administrator discovers that a table containing credit card numbers was exported, but the database audit logs do not show any direct export queries. The administrator suspects that the data was exfiltrated through a SQL injection vulnerability in a web application. The web application logs are available, but they are not correlated with the database logs. Which investigation step is most appropriate?

   • ARestore the database from a backup taken before the suspected injection.
   • BCorrelate the web application logs with the database audit logs by matching the timestamps and the SQL queries to identify the injection payload.
   • CSearch the database audit logs for any query that returned a large number of rows.
   • DReview the web application source code to identify the SQL injection vulnerability.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A server administrator notices that a configuration file for a web server was modified, and the server is now serving files from an unexpected directory. The administrator suspects that an attacker exploited a vulnerability to change the configuration. Which investigation step is most appropriate to determine the scope of the data loss?

   • ABlock the IP address of the attacker in the firewall.
   • BRestore the configuration file from a backup and restart the web server.
   • CRun a vulnerability scanner on the web server to identify the exploited vulnerability.
   • DReview the server's authentication logs and the file system timestamps for the configuration file to identify when and how the change was made.
   Reveal Solution Discussion Select an answer first