Data Sources SY0-701 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What type of information would an endpoint detection and response (EDR) tool provide?

   • AA list of all network connections across the entire network
   • BThe configuration of network firewalls
   • CThe content of emails sent and received
   • DDetailed information about processes and file activity on a host
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations center (SOC) is overwhelmed by thousands of daily alerts from their SIEM. Most are false positives. The team wants to reduce noise and focus on high-priority events. Which SIEM feature should they configure first?

   • ACreate correlation rules that combine multiple low-level events into a single, higher-fidelity alert.
   • BDisable all alerts from less critical log sources, such as DNS servers.
   • CManually review all alerts from the past month to identify patterns.
   • DIncrease the log retention period to ensure more data is available for analysis.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is legally required to preserve logs for a pending lawsuit. The IT team has a process to archive logs to a WORM (Write Once, Read Many) storage system. However, the SIEM administrator has the ability to modify logs in the SIEM. What is the most important control to ensure the archived logs are admissible as evidence?

   • AEnsure the WORM storage is configured correctly and that the SIEM administrator does not have access to modify the archived data.
   • BEnsure the SIEM administrator has a strong password to prevent unauthorized access.
   • CEnsure the logs are archived daily to minimize the window for modification.
   • DEnsure the logs are stored in a separate database from the SIEM.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a forensic investigation, an analyst needs to prove that a log file has not been altered since it was originally collected. Which control would provide the strongest evidence of log integrity?

   • AThe file's last modified timestamp from the operating system.
   • BA cryptographic hash of the log file taken at the time of collection and stored securely.
   • CThe file's size in bytes.
   • DA backup copy of the log stored on the same server.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does integrating threat intelligence into a security investigation enhance the analysis?

   • AIt automatically patches all vulnerabilities
   • BIt eliminates the need for log analysis
   • CIt provides context about known threats, such as malicious IPs or malware hashes
   • DIt guarantees the investigation will be successful
   Reveal Solution Discussion Select an answer first