Computing Resources SY0-701 Practice Questions (Page 6)

Questions 26–28

1. 26expert · hard

   A security operations center (SOC) is monitoring a critical application server. The server has a documented baseline that includes specific file hashes for critical system files. The SOC receives an alert that a file hash has changed. The change was not part of any approved change request. Which of the following is the MOST appropriate immediate action for the SOC analyst?

   • AInvestigate the alert by correlating the file change with other logs, such as process execution and user activity.
   • BUpdate the baseline to include the new file hash to prevent future alerts.
   • CRestore the file from a known-good backup immediately.
   • DIsolate the server from the network to prevent potential data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common method used to apply a secure baseline to multiple computing resources?

   • AUsing a configuration management tool to deploy standardized settings
   • BProviding users with administrative rights to adjust settings as needed
   • CManually configuring each system individually without documentation
   • DDisabling all security features to improve performance
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   Which of the following is a common source of data used for security monitoring?

   • AHardware warranty information
   • BSystem logs and network traffic
   • CMarketing campaign analytics
   • DEmployee performance reviews
   Reveal Solution Discussion Select an answer first