A SIEM administrator is configuring the system to detect unauthorized changes to critical files on a web server. Which SIEM feature is most appropriate for this task?

File integrity monitoring (FIM) that hashes critical files and alerts on changes.

Log retention policies to store more data.

Network traffic analysis to detect unusual outbound connections.

Correlation rules that analyze login events.

A security operations center (SOC) is overwhelmed by a high volume of SIEM alerts, many of which are false positives. Analysts are missing critical alerts. The SOC manager wants to improve the signal-to-noise ratio without losing important detections. Which approach is most effective?

Tune correlation rules to reduce false positives and prioritize alerts by severity and asset criticality.

Increase the log retention period to store more data.

Add more dashboards to visualize alerts.

Disable all correlation rules and rely on manual log review.

Which tool is commonly used to implement DLP by inspecting data as it is copied to a USB drive?

Network intrusion detection system (NIDS)

A server administrator notices that a server is sending large amounts of data to an external IP address. The administrator suspects a Trojan horse. Which action should the administrator take first?

Disconnect the server from the network to stop the data exfiltration.

Update the antivirus definitions and schedule a scan.

Run a full antivirus scan without disconnecting the server.

Review SIEM logs to identify the external IP address.

CompTIAServer+

Domain 3Objective 4

Mitigation Strategies SK0-005 Practice Questions (Page 1)

Part of the Security and disaster recovery domain, which accounts for 24% of the SK0-005 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–14 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

24%of the exam

Questions 1–5

1application · medium
A SIEM administrator is configuring the system to detect unauthorized changes to critical files on a web server. Which SIEM feature is most appropriate for this task?
Select an answer first
2expert · hard
A security operations center (SOC) is overwhelmed by a high volume of SIEM alerts, many of which are false positives. Analysts are missing critical alerts. The SOC manager wants to improve the signal-to-noise ratio without losing important detections. Which approach is most effective?
Select an answer first
3foundation · easy
A user reports that all their personal files have been renamed with a .encrypted extension and a message demands payment in cryptocurrency to restore access. Which type of malware is most likely responsible?
Select an answer first
4foundation · easy
Which tool is commonly used to implement DLP by inspecting data as it is copied to a USB drive?
Select an answer first
5application · medium
A server administrator notices that a server is sending large amounts of data to an external IP address. The administrator suspects a Trojan horse. Which action should the administrator take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SK0-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SK0-005” is a trademark of its owner, used for identification only.