Monitoring and Data Analysis CAS-005 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A SIEM rule is designed to detect brute-force attacks by alerting on 10 failed logins within 5 minutes. An attacker performs 9 failed logins, waits 6 minutes, and then performs 9 more. No alert is generated. What is this situation called?

   • ACorrelation error
   • BTrue positive
   • CFalse positive
   • DFalse negative
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is investigating a potential breach. The SIEM shows the following events: a failed login attempt from an external IP, followed by a successful login from the same IP, then a large data transfer to an external IP. What is the most likely scenario?

   • AThe user is using a VPN that changes IP addresses.
   • BAn attacker brute-forced the password and is exfiltrating data.
   • CThe SIEM is generating false positives due to a misconfiguration.
   • DThe user forgot their password and then logged in successfully.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A network administrator has established a baseline for network traffic that shows normal outbound traffic is 100 Mbps. One day, the SIEM alerts that outbound traffic has increased to 500 Mbps. The administrator investigates and finds that a server is sending large amounts of data to an external IP. What is the most likely cause?

   • AThe SIEM is generating a false positive due to a misconfigured baseline.
   • BThe server has been compromised and is exfiltrating data.
   • CThe server is performing a legitimate backup to an external service.
   • DA user is downloading a large file from the server.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of a user behavior baseline?

   • AThe network typically carries 100 Mbps of traffic
   • BA user typically logs in from the corporate office between 8 AM and 6 PM
   • CA server typically runs at 40% CPU utilization
   • DLogs are retained for 90 days
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security team must ensure that SIEM log data is available for incident investigation for at least one year, while also managing storage costs. Which SIEM configuration is most directly responsible for this requirement?

   • AUser access control
   • BData retention policy
   • CCorrelation rule configuration
   • DAlert threshold tuning
   Reveal Solution Discussion Select an answer first