Data Sources SY0-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A user reports that their computer is running slowly and showing pop-ups. An analyst needs to determine if the machine is infected. Which endpoint data source would provide the most direct evidence of malicious software execution?

   • AEndpoint detection and response (EDR) logs showing process creation and execution details.
   • BThe DNS query log showing the domains the workstation resolved.
   • CThe Windows Event Log showing successful logon events.
   • DThe firewall log showing outbound connections from the workstation.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security analyst needs to collect log data from a network firewall to investigate a potential intrusion. Which type of log source is the firewall?

   • AApplication log
   • BNetwork device log
   • COperating system log
   • DEndpoint detection log
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is investigating a potential data exfiltration. The firewall logs show a large outbound transfer to an IP address in a foreign country. However, the data transfer is encrypted, so the analyst cannot see the contents. The analyst checks threat intelligence and finds the IP is a known cloud storage provider. What is the most reasonable conclusion?

   • AThe transfer is benign because it is encrypted, and encrypted traffic cannot be malicious.
   • BThe transfer is likely benign, as it is going to a legitimate cloud storage provider.
   • CThe transfer is definitely malicious, as it is going to a foreign country.
   • DThe transfer is suspicious and warrants further investigation, such as checking the source host's behavior and user activity.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst notices a sudden spike in failed authentication attempts against a web server from a single IP address. The attempts stop after 10 minutes. To determine if this was a successful attack or just a scan, which log sources should the analyst examine first?

   • AThe DNS server's query logs for the same time period.
   • BThe web server's access and error logs for the time of the spike.
   • CThe firewall's traffic logs for the same time period.
   • DThe antivirus logs on the web server.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating an alert about a workstation connecting to a suspicious domain. The SIEM has no prior context on this domain. To quickly assess the risk, which action would be most effective?

   • AReview the workstation's local hosts file for any manual entries.
   • BQuery an external threat intelligence platform for reputation data on the domain.
   • CPerform a reverse DNS lookup on the domain to find its associated IP address.
   • DCheck the SIEM for other alerts involving the same domain.
   Reveal Solution Discussion Select an answer first