Data Sources SY0-701 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC analyst is investigating an alert for a suspicious file hash. The SIEM shows the hash was detected on one workstation. The analyst queries a threat intelligence platform and finds the hash is associated with a known ransomware family. However, the analyst also finds a blog post from a security researcher claiming the hash is a false positive and is actually a legitimate software update. What should the analyst do?

   • AIsolate the workstation and conduct a deeper investigation, including analyzing the file's behavior in a sandbox.
   • BTrust the researcher's blog post, as it provides a specific counter-claim.
   • CTrust the threat intelligence platform, as it is an automated and authoritative source.
   • DIgnore the alert, as the researcher's claim is more recent than the threat intelligence data.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying a new SIEM. They need to collect logs from Windows and Linux servers, network switches, and a cloud-based email service. Which approach is the most efficient for ensuring all sources are collected?

   • AInstall a log collector agent on each server and configure the network devices and cloud service to forward logs via syslog or API.
   • BOnly collect logs from the servers, as network and cloud logs are not important.
   • CUse a single agent that can be installed on all devices, including network switches.
   • DManually copy log files from each source to the SIEM on a daily basis.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's SIEM collects logs from employee workstations. During an internal investigation of a policy violation, the security team wants to search the logs for a specific employee's web browsing history. What is the most important legal and ethical consideration before proceeding?

   • ANotify the employee that they are being investigated before searching the logs.
   • BEnsure the company's acceptable use policy and employee privacy notices permit this type of monitoring.
   • CObtain a warrant from a judge before accessing the logs.
   • DVerify that the logs are stored in a country with strong data protection laws.
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   A security analyst is reviewing the organization's log management strategy. Which statement best describes the primary purpose of a log data retention policy?

   • ATo analyze log data in real time to detect and respond to security incidents.
   • BTo ensure that log data is collected from all endpoints and centralized in a single repository.
   • CTo encrypt all log data at rest and in transit to prevent unauthorized access.
   • DTo specify how long log data must be kept and when it can be deleted, balancing operational needs, legal requirements, and storage costs.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC analyst is investigating a potential breach. The SIEM shows the following events: (1) a successful VPN login for a user at 2:00 AM, (2) a large data transfer from a file server to the user's workstation at 2:15 AM, and (3) a connection from the workstation to an external IP at 2:20 AM. The user denies any activity at that time. Which correlation of events provides the strongest evidence of a compromised account?

   • AThe outbound connection is the key indicator, as it shows data leaving the network.
   • BThe large data transfer is the only suspicious event, as it indicates data exfiltration.
   • CThe successful VPN login at an unusual hour, followed by a large data transfer and an outbound connection, indicates a coordinated attack.
   • DThe events are unrelated and do not provide enough evidence to conclude a breach.
   Reveal Solution Discussion Select an answer first