Application and User Monitoring Analytics GCDA Practice Questions (Page 12)

Questions 56–58

1. 56expert · medium

   A web application's logs show a pattern of SQL injection attempts from a single IP address. The attempts are increasing in frequency and complexity, but none have been successful so far. The application is critical to business operations and cannot be taken offline. What is the best response?

   • AIgnore the attempts because they have not been successful.
   • BBlock the IP address at the web application firewall (WAF) and continue monitoring.
   • CTake the application offline to prevent any potential successful attack.
   • DReset the database credentials to prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A company's finance application normally logs 200–400 failed login attempts per day from various IPs. Over the past hour, the SIEM shows 5,000 failed logins from a single IP, followed by a successful login from that IP. The user account then executed a SQL query that returned 10,000 rows from a customer table. Which two data sources, when correlated, most directly confirm the attack chain?

   • AApplication authentication logs and database query logs
   • BFirewall logs and DNS logs
   • CUser access reviews and HR records
   • DOperating system event logs and antivirus logs
   Reveal Solution Discussion Select an answer first
3. 58foundation · easy

   Which activity is an example of using analytics for threat hunting?

   • ASearching for unusual combinations of application and user behavior that do not match known attack signatures
   • BReviewing a daily report of firewall denies
   • CResponding to an alert from an intrusion detection system
   • DUpdating antivirus signatures on endpoints
   Reveal Solution Discussion Select an answer first