Mitigation Strategies SK0-005 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a Data Loss Prevention (DLP) system?

   • ATo encrypt all data at rest on a server
   • BTo provide backup and recovery of lost data
   • CTo detect and block malware infections
   • DTo prevent unauthorized access to or transfer of sensitive data
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A server administrator discovers that a file server has been encrypting files and displaying a ransom note. The malware appears to have spread from a user workstation. The company has a backup solution, but the most recent backup is from two days ago. The administrator must restore service quickly while preserving evidence. Which approach best balances these needs?

   • APay the ransom to decrypt files quickly, then investigate the source.
   • BImmediately restore files from the backup without isolating the server, then continue normal operations.
   • CIsolate the server, restore files from the two-day-old backup, and then analyze the workstation to identify the infection source.
   • DDisconnect the server and perform a forensic analysis of the server before restoring any files.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SIEM administrator is configuring the system to detect a possible data exfiltration attempt. The organization uses both on-premises servers and cloud services. Which configuration step is essential for the SIEM to see all relevant events?

   • AEnable log forwarding from all on-premises and cloud sources to the SIEM.
   • BDefine a retention policy for SIEM logs.
   • CCreate a correlation rule that only uses firewall logs.
   • DSet up a dashboard to display alerts from the SIEM.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst needs to correlate login events from domain controllers, firewall logs, and antivirus alerts to identify a potential brute-force attack. Which SIEM feature is most directly used for this task?

   • ADashboard widgets that display real-time event counts.
   • BAgent-based collection of logs from each server.
   • CCorrelation rules that aggregate events from multiple sources and trigger alerts on patterns.
   • DLog retention policies that determine how long events are stored.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst needs to identify all login attempts to a server that occurred between 2:00 AM and 3:00 AM on a specific date. Which SIEM query would be most effective?

   • ASearch for firewall logs for the server's IP address.
   • BSearch for logon events on the server with a timestamp filter for the specified time range.
   • CSearch for all events in the SIEM without a time filter.
   • DSearch for antivirus alerts on the server.
   Reveal Solution Discussion Select an answer first