Alerting and Monitoring SY0-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary role of a Security Information and Event Management (SIEM) system?

   • ATo encrypt data at rest
   • BTo aggregate and analyze security data from multiple sources
   • CTo block malicious network traffic in real time
   • DTo manage user identities and access
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations center (SOC) is implementing a new alerting mechanism for a SIEM. The SOC wants to ensure that critical alerts are not missed during off-hours. Which approach would BEST achieve this?

   • ADisable non-critical alerts during off-hours.
   • BConfigure an escalation policy that pages the on-call analyst for critical alerts.
   • CIncrease the severity threshold for all alerts during off-hours.
   • DSend all alerts to a shared email inbox.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which log source would most likely contain evidence of an attacker modifying system configuration files on a Linux server?

   • ADNS logs
   • BFirewall logs
   • CWeb server access logs
   • DSystem logs (e.g., /var/log/syslog)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An application performance monitoring (APM) tool shows that a web application's response time has increased from an average of 200 ms to 2 seconds over the past hour. The application's CPU usage on the server is normal, but the database server's disk I/O is at 95% utilization. Which conclusion is MOST likely?

   • AThe application server is under-provisioned.
   • BThe database server is the bottleneck causing the slow response times.
   • CThe network between the application and database is congested.
   • DThe web application has a memory leak.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) is receiving a high volume of alerts from its SIEM, many of which are false positives. The SOC team is becoming desensitized to alerts and may miss critical incidents. Which approach would BEST reduce alert fatigue while maintaining effective monitoring?

   • ADisable alerts for low-priority events to reduce noise.
   • BTune the SIEM correlation rules and use baseline analysis to adjust thresholds.
   • CRoute all alerts to a single analyst for manual review.
   • DIncrease the severity threshold for all alerts so only high-severity alerts are generated.
   Reveal Solution Discussion Select an answer first