3.3 Use Log Viewer and the Incidents and Alerts Page to Remediate Incidents and Alerts NETWORK-SECURITY-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team receives multiple alerts: one for a critical server attempting to connect to a known command-and-control IP, one for a low-priority user visiting a phishing site, and one for a malware signature detected on a non-critical workstation. The team has limited resources and must prioritize. Which alert should be investigated first?

   • AThe malware signature on a non-critical workstation
   • BAll alerts should be investigated simultaneously
   • CThe critical server connecting to a known C2 IP
   • DThe low-priority user visiting a phishing site
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When navigating the Log Viewer, what is the purpose of the timeline histogram displayed at the top of the page?

   • AIt displays the severity levels of the log entries in a pie chart format.
   • BIt shows the total number of logs that have been exported from the system.
   • CIt provides a list of all available log types that can be selected.
   • DIt shows the number of log entries over time, allowing you to identify periods of high activity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   On the Incidents and Alerts page, what is the primary function of the 'Incidents' tab?

   • AIt displays a list of grouped security incidents that require investigation.
   • BIt allows you to configure security policies for the firewall.
   • CIt provides a dashboard of firewall performance metrics.
   • DIt shows the raw log entries for all traffic on the network.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   After blocking a malicious IP in the firewall, an analyst wants to verify that the block is effective and that no further traffic from that IP is being allowed. Which action in Log Viewer best verifies the remediation?

   • AVerify the security policy rule is enabled in the firewall configuration
   • BCheck the Incidents and Alerts page for any new alerts involving the blocked IP
   • CReview the threat logs for any new threats from the blocked IP
   • DSearch traffic logs for the blocked IP as source and check for any new entries after the block was applied
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is investigating an incident and needs to view all traffic logs for a specific user's IP address. The analyst is currently on the Incidents and Alerts page. What is the most efficient way to access the relevant traffic logs?

   • AExport all traffic logs to a file and search locally
   • BUse the dashboard to view traffic logs
   • COpen Log Viewer and browse through all traffic logs manually
   • DClick on the alert and select 'View in Log Viewer' or navigate to Log Viewer and apply a filter for the IP address
   Reveal Solution Discussion Select an answer first