Monitoring and Data Analysis CAS-005 Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   A security analyst reviews SIEM data over the past three months and notices a gradual increase in outbound traffic volume every week. What type of analysis is this?

   • ACorrelation analysis
   • BRetention policy management
   • CTrend analysis
   • DFalse positive tuning
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices that the SIEM is generating hundreds of alerts for a specific signature that detects SQL injection attempts. Upon review, the alerts all originate from a single internal web application that is a honeypot designed to attract attackers. The analyst wants to reduce noise while still preserving visibility into real attacks against production systems. What is the most appropriate action?

   • ADisable the signature globally in the SIEM to stop all alerts for that signature.
   • BIncrease the alert threshold for the signature to require at least 10 occurrences in one minute.
   • CAdd a correlation rule that only triggers when the signature fires against production web servers, and tune the original rule to exclude the honeypot.
   • DCreate a suppression rule that filters out alerts from the honeypot's source IP address.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company's SIEM retention policy currently stores all logs for 12 months. The storage costs are rising, and the security team wants to reduce expenses while still meeting compliance requirements that mandate 90 days of searchable logs for incident response. They also want to keep historical data for trend analysis. What is the most cost-effective approach?

   • AIncrease the retention period to 24 months to ensure ample data for future analysis.
   • BKeep 90 days of hot, searchable storage and archive older logs to cold, cheaper storage for trend analysis.
   • CStore only security-related logs for 90 days and delete all other logs immediately.
   • DReduce the retention period for all logs to 90 days and delete everything older.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A server administrator has set up a baseline for a critical application server. The baseline shows that the server's CPU usage averages 40% with occasional spikes to 60% during batch jobs. One day, the SIEM alerts that the server's CPU usage has been at 95% for over an hour. The administrator checks and finds that a new scheduled task was added by the development team to run a data processing job every hour. What is the most appropriate action?

   • AUpdate the baseline to reflect the new CPU usage pattern.
   • BIncrease the alert threshold for CPU usage to 100% to avoid false positives.
   • CInvestigate the scheduled task to confirm it is legitimate and assess its impact on performance.
   • DRemove the scheduled task immediately to restore normal CPU usage.
   Reveal Solution Discussion Select an answer first