4.3 Modify a Provided Script to Automate a Security Operations Task 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A Python script is designed to read a list of IP addresses from a file named 'input.txt' and write the results to 'output.txt'. The analyst needs to change the script to read from a CSV file named 'alerts.csv' instead. Which part of the script should be modified?

   • AThe open() call that specifies the input file path
   • BThe variable name used for the file object
   • CThe output file path in the write operation
   • DThe print() function used to display results
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Python script reads a file that may not exist. The analyst wants to add error handling so the script prints a message and exits gracefully instead of crashing. Which code addition is appropriate?

   • AAdd a print statement before the open call
   • BChange the file extension to .txt
   • CUse a while loop to keep trying to open the file
   • DWrap the file open in a try-except block and catch FileNotFoundError
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security analyst is given a Python script that reads a log file and prints each line. The analyst needs to modify the script so it only prints lines that contain the string 'Failed password'. Which code change accomplishes this?

   • AReplace the file reading mode from 'r' to 'rb'
   • BUse the replace method: line.replace('Failed password', '')
   • CChange the print function to print(line, 'Failed password')
   • DAdd an if statement: if 'Failed password' in line: print(line)
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A script correlates events by matching source IP addresses. The analyst needs to modify the script to also correlate by destination IP. Which change is most appropriate?

   • ARemove the source IP correlation to avoid confusion
   • BUse a print statement to display both IPs
   • CAdd a second correlation step that groups events by destination IP
   • DChange the variable name from source_ip to dest_ip
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A script has been modified to filter out low-severity events. The analyst has a test file with 10 events, 3 of which are low severity. What is the expected output if the script works correctly?

   • A7 events, with no low-severity events included
   • B0 events, because all events are filtered out
   • C3 events, only the low-severity events
   • D10 events, including all low-severity events
   Reveal Solution Discussion Select an answer first