Alerting and Monitoring SY0-701 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security analyst is reviewing authentication logs and notices multiple failed login attempts for a single user account from different IP addresses within a short time. What is the most likely security incident this indicates?

   • AA malware infection
   • BA brute-force attack
   • CA distributed denial-of-service (DDoS) attack
   • DA phishing email
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst is reviewing logs from a web server and notices that a user has successfully logged in from an IP address in a foreign country, but the user is currently on vacation and has not traveled. The analyst also sees that the user's account has been used to access sensitive files. Which action should the analyst take FIRST?

   • AInvestigate the IP address and correlate with other logs to determine if this is a compromised account.
   • BDisable the user's account immediately.
   • CContact the user to verify if they logged in from the foreign IP.
   • DReset the user's password and force a re-login.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An application performance monitoring (APM) tool reports that a web application's response time has increased from 200 ms to 2 seconds. What is the most likely purpose of this metric?

   • ATo block the application from being accessed
   • BTo identify a potential performance degradation or issue
   • CTo encrypt the application's data
   • DTo replace the application's code
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is reviewing network flow data and notices that a server is sending data to an external IP address on a port that is not typically used by the organization. The analyst checks the SIEM and finds no alerts for this activity. Which action should the analyst take?

   • AIgnore the activity because the SIEM did not alert.
   • BAdd a SIEM rule to alert on this traffic pattern.
   • CInvestigate the destination IP and the data being sent.
   • DBlock all traffic to the external IP address.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An application performance monitoring (APM) tool shows that a web application's error rate has increased from 0.1% to 5% over the past 15 minutes. The application's response time is normal, and the server's CPU and memory usage are within baseline. Which action should the administrator take FIRST?

   • ARestart the application server to clear the errors.
   • BIncrease the server's memory allocation.
   • CRoll back the most recent application deployment.
   • DCheck the application logs to identify the cause of the errors.
   Reveal Solution Discussion Select an answer first