4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is log normalization important when analyzing logs from different sources?

   • AIt converts all logs into a common format for consistent analysis
   • BIt reduces the volume of logs by deleting duplicate entries
   • CIt assigns severity levels to logs based on their content
   • DIt encrypts logs to protect them from unauthorized access
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is investigating a potential malware infection on a user's workstation. The endpoint detection and response (EDR) tool shows the malware was downloaded from a website. The firewall logs show the user's workstation connecting to the website's IP address. The proxy logs show the URL requested. Which additional data source would best help the analyst determine whether the malware executed and what it did?

   • AThe workstation's Windows Event Logs for process creation and network connections
   • BThe DNS logs for the website's domain
   • CThe BIG-IP ASM logs for the website's traffic
   • DThe Active Directory logs for the user's logon events
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is deploying a new SIEM and must decide how to collect logs from BIG-IP devices, firewalls, and servers. The security team wants to ensure logs are not lost during network outages and that they can be replayed once the connection is restored. Which log collection method best meets this requirement?

   • AUse a message queue or a reliable syslog implementation (e.g., syslog over TCP with TLS) that buffers logs locally until the SIEM acknowledges receipt
   • BConfigure the devices to send logs via syslog over UDP to the SIEM
   • CStore logs only on the devices and have the SIEM access them on demand
   • DHave the SIEM poll each device's logs via API on a schedule
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SIEM correlation rule alerts when a user logs in to the VPN and then accesses an internal file share within 10 minutes. The rule fires for a user who is a known contractor. The analyst reviews the logs and finds the contractor logged in from a new IP address and accessed files they have never accessed before. The contractor's manager confirms the contractor is on a new project. Which action is most appropriate?

   • AImmediately block the contractor's VPN access
   • BClose the alert as a false positive because the manager confirmed the activity is legitimate
   • CKeep the alert open and investigate the new IP address and file access patterns further
   • DDisable the correlation rule for the contractor's account
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A SIEM receives logs from BIG-IP, Check Point firewalls, and Linux servers. The analyst is building a correlation rule to detect port scans. The BIG-IP logs use 'dest_port', the Check Point logs use 'destination_port', and the Linux logs use 'dport'. The analyst wants to write a single rule that references the destination port. What is the most efficient approach?

   • ACreate a parsing rule that maps all three field names to a common field, such as 'dest_port'
   • BConfigure the BIG-IP, Check Point, and Linux devices to use the same field name
   • CWrite three separate rules, one for each log source's field name
   • DUse a regex in the rule to extract the port from the raw message
   Reveal Solution Discussion Select an answer first