4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SIEM correlation rule flags an event when a user logs in to the VPN and then accesses an internal server within 5 minutes. The rule fires frequently for a specific user who is a system administrator. The analyst reviews the logs and finds that the admin's VPN login is always followed by a scheduled script that connects to the server. What is the most appropriate action to reduce false positives?

   • AIgnore the alerts for this user without changing the rule
   • BModify the correlation rule to exclude the specific script's service account from the alert
   • CIncrease the time window from 5 minutes to 30 minutes
   • DDisable the correlation rule entirely
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is required to retain security logs for 3 years for compliance. They currently store logs in a SIEM with a 1-year hot retention and then archive to cold storage. During a forensic investigation of an incident that occurred 2 years ago, the analyst needs to search the archived logs. The cold storage retrieval takes 24 hours. The incident response plan requires initial findings within 4 hours. What is the best approach to meet both the compliance and investigation requirements?

   • ARestore the archived logs to the SIEM hot storage, accepting the 24-hour delay for the initial findings
   • BRequest an exception to the 4-hour requirement because the incident is 2 years old
   • CStore all logs in cold storage for 3 years and retrieve only when needed
   • DMaintain a subset of critical logs (e.g., authentication and firewall) in hot storage for 3 years, and archive the rest
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is investigating a suspected data breach. The BIG-IP ASM logs show a successful SQL injection attack against a web application at 2:00 PM. The database server logs show a large data export at 2:15 PM. However, the firewall logs show no outbound traffic from the database server at that time. The analyst must determine whether data was actually exfiltrated. Which conclusion is best supported by the available evidence?

   • AThe evidence is insufficient to confirm exfiltration without additional data sources, such as NetFlow or the database's audit logs
   • BThe data was exfiltrated over an encrypted channel that the firewall could not inspect
   • CThe data was exfiltrated via the web application, not directly from the database server
   • DThe data export was likely a legitimate database backup, not exfiltration
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company must retain security logs for 12 months to meet a regulatory requirement. They currently store BIG-IP, firewall, and Active Directory logs on each device locally, with only 30 days of history. The security team needs a central repository to search all logs quickly during an investigation. Which approach best satisfies both the retention and searchability requirements?

   • AConfigure a syslog server to receive and store logs from all devices for 12 months, with indexed search capability
   • BExport logs to CSV files monthly and store them on a network share for 12 months
   • CIncrease local storage on each device to hold 12 months of logs and search each device individually during investigations
   • DEnable BIG-IP high-speed logging (HSL) to send logs to a remote disk, but keep other devices local
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company aggregates logs from BIG-IP, Cisco ASA firewalls, and Windows servers into a SIEM. The analyst notices that the source IP field is sometimes populated with the client IP and sometimes with the proxy IP, depending on the log source. This inconsistency is causing correlation rules to miss attacks. What is the most effective way to resolve this issue?

   • AManually review each log entry to determine the correct source IP
   • BConfigure the proxy to stop adding the X-Forwarded-For header
   • CCreate a normalization rule that maps the 'source IP' field from each device to a common field, and document which devices report proxy IPs
   • DUse only the BIG-IP logs for correlation rules
   Reveal Solution Discussion Select an answer first