Monitoring and Data Analysis CAS-005 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A user behavior baseline shows that a user typically accesses the CRM system between 8 AM and 6 PM. One day, the SIEM alerts that the user accessed the CRM at 11 PM. The user is a known night owl and often works late. What is the most appropriate action?

   • ADisable the user's account to prevent further access.
   • BInvestigate the access to confirm it is the user and not an attacker.
   • CIgnore the alert because the user often works late.
   • DUpdate the baseline to include late-night access.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is reviewing SIEM data and notices that the number of phishing emails detected has increased by 20% each month for the past three months. What is the most appropriate action?

   • AIgnore the trend because it's just a seasonal variation.
   • BDelete the historical data to free up storage space.
   • CIncrease the alert threshold for phishing to reduce false positives.
   • DInvestigate the cause of the increase and consider adjusting security controls.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A SIEM generates two alerts: one for a failed login on a test server and another for a successful login to a domain controller followed by a privilege escalation. Which alert should be prioritized first?

   • ABoth alerts equally, because all alerts are equally important
   • BThe domain controller alert, because it indicates a potential compromise of a critical system
   • CThe failed login on the test server, because it occurred first
   • DThe failed login, because it is easier to investigate
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A system administrator wants to monitor a server for unusual CPU usage, memory consumption, and process activity. What should be established to detect deviations?

   • AA data retention policy
   • BA system behavior baseline
   • CA user behavior baseline
   • DA network behavior baseline
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator has established a baseline for network traffic that shows normal HTTP traffic is 200 Mbps. One day, the SIEM alerts that HTTP traffic has dropped to 50 Mbps. The administrator checks and finds that a major web server is down. What is the most likely cause of the alert?

   • AA DDoS attack is blocking traffic to the server.
   • BThe server is down, causing a drop in traffic.
   • CThe SIEM is generating a false positive due to a misconfigured baseline.
   • DUsers are on vacation, so traffic is naturally lower.
   Reveal Solution Discussion Select an answer first