3.3 Use Log Viewer and the Incidents and Alerts Page to Remediate Incidents and Alerts NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst opens the Incidents and Alerts page and sees a list of alerts. The analyst wants to quickly identify which alerts are most critical and require immediate attention. Which feature on the Incidents and Alerts page should the analyst use?

   • AView the alert details for each alert
   • BSort the alerts by severity
   • CExport the alerts to a CSV file
   • DFilter the alerts by status
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An alert indicates that a user's workstation is sending data to an external IP. The analyst wants to understand the full context of the incident, including whether the user visited a malicious website and if any other hosts are involved. Which approach in Log Viewer provides the most comprehensive view?

   • AOnly review the traffic logs for the workstation's IP
   • BCorrelate traffic logs, URL filtering logs, and threat logs for the workstation's IP and the external IP
   • COnly review the threat logs for the external IP
   • DOnly review the URL filtering logs for the external IP
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a key component of the Incidents and Alerts page?

   • AA configuration panel for setting up new security zones.
   • BA graph showing CPU and memory usage of the firewall.
   • CA log of administrative actions taken by firewall administrators.
   • DA list of alerts with severity indicators and status.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst is investigating a security incident. Which of the following actions is an example of log correlation?

   • ASorting the Traffic log by destination IP address.
   • BReviewing the Threat log for a specific signature and then checking the Traffic log for the same source IP to see the full session details.
   • CExporting the Threat log to a PDF for documentation purposes.
   • DChanging the time range in the Log Viewer to view logs from the last 24 hours.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of categorizing incidents during triage?

   • ATo automatically delete incidents that are not critical.
   • BTo group similar incidents together for more efficient handling and analysis.
   • CTo determine the exact source code of the malware involved.
   • DTo assign a monetary value to each incident for billing purposes.
   Reveal Solution Discussion Select an answer first