Monitoring and Data Analysis CAS-005 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A SIEM alerts when network traffic deviates from the established baseline. What is the primary purpose of this baseline?

   • ATo prioritize alerts
   • BTo parse log fields
   • CTo reduce storage costs
   • DTo detect anomalies in network behavior
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security team wants to detect unusual network activity by establishing what is 'normal' for their environment. What should they create?

   • AA network behavior baseline
   • BA data retention policy
   • CA correlation rule
   • DA user access control list
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which factor is MOST important when prioritizing security events in a SIEM?

   • AThe source IP address of the event
   • BThe potential impact on critical assets
   • CThe number of events in the log
   • DThe time of day the event occurred
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a potential data breach. The SIEM shows a successful login from an external IP, followed by a download of a large file from a file server, and then a connection to a known command-and-control (C2) server. What is the most likely attack chain?

   • AThe SIEM is correlating unrelated events due to a misconfiguration.
   • BAn attacker compromised the account, exfiltrated data, and established a C2 channel.
   • CThe user is working remotely and downloading a file, and the C2 connection is a false positive.
   • DThe file download triggered a false positive on the C2 rule.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A system administrator has a baseline for a web server that shows normal CPU usage is 30%. One day, the SIEM alerts that CPU usage is at 100% for 30 minutes. The administrator investigates and finds that a new web application is consuming excessive CPU. The application is critical to business operations. What is the most appropriate action?

   • AUpdate the baseline to reflect the new CPU usage.
   • BIncrease the alert threshold for CPU usage to 100% to avoid false positives.
   • CInvestigate the application's performance and optimize it to reduce CPU usage.
   • DKill the web application process to restore normal CPU usage.
   Reveal Solution Discussion Select an answer first