A security analyst notices that a single user account has successfully authenticated to the VPN at 2:00 AM, 3:00 AM, and 4:00 AM from three different countries. The user's normal working hours are 9 AM to 5 PM in the United States. Which log analysis technique would most directly flag this as a potential security incident?

Comparing the login times and source locations against the user's established baseline behavior

Correlating the VPN logins with the user's Active Directory account status

Checking the BIG-IP APM logs for the user's previous session durations

Reviewing the firewall logs for the user's source IP addresses

What is the purpose of data source triangulation in incident analysis?

To automatically generate incident reports

To replace the need for manual log review

To reduce the number of logs that need to be stored

To validate and enrich incident findings by combining multiple data sources

F5Certified Solution Expert, Security

Domain 4Objective 1

4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 3)

Part of the SECURITY RESPONSE domain, which makes up ~24% of our current practice bank. F5 does not publish an official question count, but from its 105-minute exam (~40–70 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 11–15

11application · medium
A security analyst notices that a single user account has successfully authenticated to the VPN at 2:00 AM, 3:00 AM, and 4:00 AM from three different countries. The user's normal working hours are 9 AM to 5 PM in the United States. Which log analysis technique would most directly flag this as a potential security incident?
Select an answer first
12foundation · easy
Which log source is most likely to contain records of firewall rule hits and blocked traffic during a security incident?
Select an answer first
13foundation · easy
During a security incident analysis, an analyst needs to review authentication attempts against a web application. Which log source would most directly provide this information?
Select an answer first
14foundation · easy
Which log field is most essential for timeline reconstruction?
Select an answer first
15foundation · easy
What is the purpose of data source triangulation in incident analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 401

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by F5. “401” is a trademark of its owner, used for identification only.

4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 3)

Questions 11–15

Which log source is most likely to contain records of firewall rule hits and blocked traffic during a security incident?

During a security incident analysis, an analyst needs to review authentication attempts against a web application. Which log source would most directly provide this information?

Which log field is most essential for timeline reconstruction?

What is the purpose of data source triangulation in incident analysis?

Keep studying — SECURITY RESPONSE