Monitoring and Data Analysis CAS-005 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is required to retain security logs for at least one year for compliance. The SIEM storage is filling up quickly, and the security team wants to ensure they can still search logs from the past year for investigations. What is the most appropriate action?

   • ACompress the logs to reduce storage usage while keeping them searchable.
   • BIncrease the retention period to two years to ensure compliance.
   • CMove logs to a separate, slower storage system that is not searchable.
   • DDelete logs older than six months to free up space.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization is required by regulation to keep security logs for 18 months. The SIEM currently stores logs for 6 months. What is the most appropriate action to meet this requirement?

   • ADisable log collection for non-critical sources
   • BIncrease the SIEM data retention period to 18 months
   • CIncrease alert severity thresholds
   • DImplement real-time correlation rules
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst wants to detect when a user accesses files at unusual times or from unusual locations. What should be established?

   • AA data retention policy
   • BA network behavior baseline
   • CA user behavior baseline
   • DA system behavior baseline
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing SIEM logs and notices that a single event contains multiple fields, including source IP, destination IP, user agent, and a URL. The analyst wants to extract the destination IP and the URL to correlate with other events. What is the most efficient way to do this in a SIEM?

   • AManually copy the values from the raw log into a spreadsheet for analysis.
   • BUse the SIEM's field extraction feature to define the fields and parse them automatically.
   • CSearch for the event in the SIEM and use the 'show only these fields' option to display them.
   • DUse a regular expression to parse the raw log and extract the fields.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator has established a baseline for normal network traffic in the organization. The baseline shows that the average inbound traffic is 500 Mbps with occasional spikes to 800 Mbps during backups. One day, the SIEM alerts that inbound traffic has reached 1.2 Gbps for 30 minutes. The analyst checks and finds that a new marketing campaign is driving legitimate traffic to the website. What should the analyst do first?

   • AUpdate the baseline to reflect the new normal traffic level.
   • BIncrease the alert threshold to 1.5 Gbps to avoid future false positives.
   • CBlock all traffic from the marketing campaign's IP range to prevent potential overload.
   • DInvestigate the source of the traffic to confirm it is legitimate and not an attack.
   Reveal Solution Discussion Select an answer first