Mitigation Strategies SK0-005 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   During a forensic investigation, an analyst needs to prove that a specific user account was used to access a file server at a particular time. The SIEM has collected logs from the file server, domain controller, and firewall. Which set of logs would provide the most direct evidence?

   • AFile server security logs showing successful logon events for the user account.
   • BDomain controller logs showing authentication for the user account.
   • CAntivirus logs showing scans on the file server.
   • DFirewall logs showing traffic from the user's workstation IP to the file server.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which practice is most effective in preventing malware infections by addressing newly discovered vulnerabilities in server software?

   • ARegularly applying security patches and updates
   • BUsing the same password for all administrator accounts
   • CGranting all users local administrator rights
   • DDisabling the host-based firewall
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of configuring correlation rules in a SIEM?

   • ATo encrypt log data at rest
   • BTo reduce the amount of log data collected
   • CTo replace the need for antivirus software
   • DTo identify patterns that indicate a security incident
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational company must prevent sensitive source code from being uploaded to public code repositories. The DLP solution is deployed at the network perimeter. However, developers frequently use encrypted VPN tunnels to remote sites. What is the most effective way to extend DLP coverage to this traffic?

   • ABlock all outbound traffic to public code repositories.
   • BConfigure the network DLP to decrypt all VPN traffic for inspection.
   • CUse SIEM to monitor for large outbound transfers.
   • DDeploy endpoint DLP agents on developer workstations to monitor file uploads regardless of encryption.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial firm wants to prevent credit card numbers from being transmitted via web forms to unauthorized external sites. The DLP solution is deployed as a network appliance. Which policy configuration would best achieve this goal?

   • ARestrict access to the DLP management console to security administrators.
   • BBlock outbound HTTP/HTTPS requests that contain credit card number patterns to unapproved domains.
   • CLog all web form submissions for later review.
   • DEncrypt all outbound web traffic using TLS.
   Reveal Solution Discussion Select an answer first