Alerting and Monitoring SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst reviews the firewall logs and sees that a large amount of data was transferred from an internal server to an external IP address over SFTP. The analyst also checks the SIEM and finds no alerts for this activity. Which conclusion is MOST likely?

   • AThe SIEM is not configured to monitor SFTP traffic.
   • BThe firewall logs are inaccurate.
   • CThe SIEM alert was suppressed by the analyst.
   • DThe data transfer was legitimate and does not require an alert.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing a SIEM dashboard and notices that a single user account has generated 500 failed login events in the past 10 minutes, originating from multiple source IPs. The SIEM has a correlation rule that triggers an alert when 10 failed logins occur within 5 minutes. Which action should the analyst take FIRST?

   • AAcknowledge the alert and continue monitoring, as the SIEM rule already captured the event.
   • BIncrease the SIEM correlation rule threshold to 100 failed logins to reduce alert noise.
   • CInvestigate the source IPs and correlate the events with other logs to determine if this is a genuine brute-force attack.
   • DDisable the user account immediately to prevent further unauthorized access.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A network administrator needs to monitor the volume of traffic between different hosts to identify which pairs of devices communicate most frequently. Which tool is best suited for this task?

   • ASNMP
   • BNetFlow
   • CPacket analyzer
   • DSyslog server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator has been monitoring a server's network traffic for several months and has established a baseline showing that the server typically sends 10 Mbps of traffic during business hours. Today, the server is sending 50 Mbps of traffic. Which action should the administrator take?

   • AInvestigate the cause of the traffic increase to determine if it is legitimate.
   • BIgnore the increase because the server is still operational.
   • CUpdate the baseline to reflect the new traffic level.
   • DImmediately block all traffic from the server.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of an alerting mechanism in a security monitoring system?

   • ATo automatically patch vulnerabilities
   • BTo notify administrators of potential security issues
   • CTo replace the need for log analysis
   • DTo encrypt sensitive data
   Reveal Solution Discussion Select an answer first