Data Sources SY0-701 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A global company is subject to the EU's General Data Protection Regulation (GDPR). They store logs that may contain personal data of EU citizens in a SIEM located in the US. A data subject requests access to all their personal data. What is the most important consideration for the security team?

   • AThe team must be able to search the SIEM for all logs related to the data subject and provide them in a structured format.
   • BThe team must obtain consent from the data subject before accessing the logs.
   • CThe team must move the SIEM to the EU to comply with GDPR.
   • DThe team must immediately delete all logs containing the data subject's personal data.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a key legal consideration when using log data in a security investigation?

   • AMaking logs available to all employees
   • BEnsuring logs are stored in a public cloud
   • CDeleting logs immediately after an investigation
   • DCompliance with privacy laws and regulations
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common method to protect the integrity of log data?

   • AStoring logs in plain text for easy access
   • BAllowing all users to edit logs
   • CDeleting logs after a short period
   • DUsing cryptographic hashes to detect tampering
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of an endpoint data source?

   • AFirewall rule base
   • BRouter configuration
   • CSwitch port statistics
   • DAntivirus detection logs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic investigator is examining a compromised server. The EDR logs show a suspicious process was executed, but the logs have been partially deleted. The investigator also has a memory dump from the server. Which data source would be most valuable for reconstructing the attack?

   • AThe system's event logs, which may show user logon activity.
   • BThe network flow logs, which may show connections to a C2 server.
   • CThe partially deleted EDR logs, as they may still contain some relevant information.
   • DThe memory dump, as it may contain remnants of the malicious process and its activities.
   Reveal Solution Discussion Select an answer first