Mitigation Strategies SK0-005 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SIEM administrator needs to configure the system to detect a potential brute-force attack on a critical database server. The attack is expected to involve multiple failed logins from different IP addresses over a short period. Which SIEM configuration is most appropriate?

   • ASet up a dashboard to display all failed login events in real time.
   • BCreate a correlation rule that triggers when the number of failed login events from multiple sources exceeds a threshold within a time window.
   • CConfigure the SIEM to block IP addresses after three failed logins.
   • DEnable log collection from the database server only.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How can a SIEM support incident response during a security breach?

   • ABy providing a centralized view of logs and alerts to help identify the scope of the incident
   • BBy automatically patching affected servers
   • CBy blocking all network traffic during the incident
   • DBy restoring data from backups
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which SIEM feature is most useful for forensic investigations after an incident?

   • APassword reset functionality
   • BAutomatic malware removal
   • CReal-time traffic blocking
   • DLong-term log storage and search capabilities
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating a potential malware outbreak. The SIEM has collected logs from multiple sources. Which SIEM feature would help the analyst quickly identify all affected systems?

   • ASearch for events related to the malware's indicators of compromise (IOCs) across all log sources.
   • BSet up a new correlation rule for future detections.
   • CGenerate a compliance report for the past month.
   • DConfigure a new dashboard to display real-time alerts.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A server administrator notices that several file servers are exhibiting high CPU usage and slow response times. An antivirus scan reveals a file that replicates itself across network shares and modifies documents to include a malicious macro. The administrator needs to contain the spread and prevent recurrence. Which action should the administrator take FIRST?

   • AUpdate the antivirus definitions and schedule a scan for off-peak hours.
   • BEnable the firewall on each server to block inbound SMB traffic.
   • CDisconnect the affected servers from the network and run a full antivirus scan.
   • DReview SIEM logs to identify the source of the initial infection.
   Reveal Solution Discussion Select an answer first