3.3 Use Log Viewer and the Incidents and Alerts Page to Remediate Incidents and Alerts NETWORK-SECURITY-ANALYST Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What does it indicate if, after remediation, you still see alert activity from the same source?

   • AThe firewall is malfunctioning and needs to be replaced.
   • BThe remediation was successful and the alerts are just delayed.
   • CThe remediation may not have been applied correctly or the source is using a different path.
   • DThe alerts are false positives and can be ignored.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is investigating an alert that shows a user's workstation communicating with a known malicious IP. The analyst wants to stop the communication immediately and also prevent future communication. Which remediation action should the analyst take?

   • AOnly terminate the active session
   • BTerminate the active session from the workstation to the malicious IP and then create a security policy rule to block the IP
   • CDisable the user's account
   • DOnly create a security policy rule to block the IP
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst resolves a security incident involving a compromised user account. The analyst needs to document the incident for compliance and future reference. What should the analyst include in the documentation?

   • AA summary of the incident without technical details
   • BThe incident timeline, evidence gathered, actions taken, and lessons learned
   • COnly the final remediation action taken
   • DThe names of all users involved in the incident
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An alert indicates that a user downloaded a file from an external site. The analyst needs to determine if the file is malicious and if any other users downloaded the same file. Which steps should the analyst take in Log Viewer?

   • ASearch the threat logs for the file's signature
   • BSearch the traffic logs for the file's download event, then search for the same file's hash in the logs to find other downloads
   • CSearch the configuration logs for changes to the user's profile
   • DSearch the URL filtering logs for the external site
   Reveal Solution Discussion Select an answer first