Data Sources SY0-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is reviewing network traffic and sees a workstation communicating with an IP address that is not on any internal allowlist. The traffic is encrypted and uses a non-standard port. The analyst checks threat intelligence and finds the IP is associated with a known command-and-control (C2) server. What is the most appropriate next step?

   • AIgnore the traffic because it is encrypted and cannot be analyzed.
   • BAdd the IP address to the allowlist to prevent future alerts.
   • CBlock the specific IP address at the firewall and continue monitoring.
   • DIsolate the workstation from the network and begin a deeper investigation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which ethical principle should guide an analyst when accessing log data during an investigation?

   • AOnly access data that is necessary for the investigation
   • BUse the data for personal gain
   • CModify logs to support a conclusion
   • DShare all findings publicly
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An analyst finds a file hash in a log and wants to know if it is associated with known malware. What is the best source of information?

   • AThreat intelligence feeds that list known malicious file hashes
   • BThe firewall rule base
   • CThe local DNS server logs
   • DThe router's routing table
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it important to ensure the integrity of log data used in a security investigation?

   • ATo reduce the storage space required
   • BTo make the logs easier to read
   • CTo speed up the log analysis process
   • DTo ensure the evidence is trustworthy and admissible in court
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security team needs to centralize logs from a mix of on-premises Linux servers, a cloud-based SaaS application, and network firewalls. The compliance team requires 18 months of retention for firewall logs but only 6 months for application logs. The team wants to minimize the number of tools they must learn and maintain. Which approach best meets these requirements?

   • AHave each source store its own logs locally and only send alerts to the SIEM for correlation.
   • BForward all logs to the SIEM and apply a single 18-month retention policy to every log source.
   • CConfigure each source to send logs to a single SIEM platform, and set up separate retention policies per log source type.
   • DStore firewall logs in a dedicated log management appliance and send application logs directly to the SIEM for analysis.
   Reveal Solution Discussion Select an answer first