4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A firewall log shows a large outbound file transfer from a database server to an unknown external IP. The transfer occurred at 3:00 AM. The analyst wants to confirm whether this was a legitimate backup or a data exfiltration. Which combination of data sources would provide the strongest evidence?

   • ADatabase server logs and the backup application's job logs
   • BDNS logs and NetFlow records
   • CBIG-IP ASM logs and web server access logs
   • DActive Directory logs and DHCP logs
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of aggregating logs from multiple sources into a central location?

   • ATo replace the need for individual log sources to generate logs
   • BTo enable correlation and analysis of events across the entire infrastructure
   • CTo reduce the storage space required for each individual log source
   • DTo automatically remediate security incidents without human intervention
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of correlating log events from different sources?

   • ATo assign severity levels to individual log entries
   • BTo ensure logs are stored in a compliant manner
   • CTo identify patterns that may indicate a security incident
   • DTo reduce the number of logs generated by each source
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which scenario would most likely be flagged as an anomaly in log analysis?

   • AA user account authenticating from a new geographic location at 3:00 AM
   • BA firewall blocking a known malicious IP address
   • CA server receiving a steady number of requests per hour
   • DA user logging in from the same location at the same time every day
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which combination of data sources would best validate a suspected data exfiltration incident?

   • ABattery logs and temperature logs
   • BFirewall logs and DNS logs
   • CPrinter logs and fax logs
   • DCPU usage logs and memory logs
   Reveal Solution Discussion Select an answer first