Mitigation Strategies SK0-005 Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   During an incident response, an analyst needs to determine the scope of a data breach by identifying which records were accessed. The SIEM has logs from the database server. Which SIEM query would be most useful?

   • ASearch database access logs for queries that returned sensitive data during the incident timeframe.
   • BSearch firewall logs for connections to the database server.
   • CSearch antivirus logs for malware detections.
   • DSearch system event logs for service restarts.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company's servers are infected with a virus that spreads through removable media. The administrator wants to prevent this type of infection. Which control is most effective?

   • AConfigure SIEM to alert on new USB devices.
   • BDisable autorun for removable media and enforce antivirus scanning of USB drives.
   • CIncrease the frequency of full system backups.
   • DEnable the Windows firewall on all servers.
   Reveal Solution Discussion Select an answer first
3. 33foundation · easy

   Which action is part of implementing a DLP policy to control data flow?

   • ADefining rules that block or alert on emails containing sensitive data
   • BConfiguring RAID to protect against disk failure
   • CInstalling a network firewall to filter inbound traffic
   • DEnabling full-disk encryption on all servers
   Reveal Solution Discussion Select an answer first