Build and Populate Effective Security Reports. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   To populate a security report on malware detections, which field is essential to extract from the relevant data source?

   • AThe signature name of the detected threat
   • BThe web browser version
   • CThe user's favorite color
   • DThe DNS server IP address
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A report on phishing emails shows a high number of detections from a specific email gateway. You notice that the counts are significantly higher than expected. What is the most likely cause of this discrepancy?

   • AThe report's time range is too narrow
   • BThe email gateway is sending duplicate events to Splunk
   • CThe report is using the wrong index
   • DThe report is scheduled too frequently
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are building a report on data exfiltration attempts. The report should include the source IP, destination IP, and the amount of data transferred. Which data source is most appropriate?

   • AVulnerability scan logs, which include fields like host and port
   • BEndpoint detection logs, which include fields like process and file_name
   • CAuthentication logs, which include fields like user and src_ip
   • DProxy logs, which include fields like src_ip, dest_ip, and bytes_sent
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are designing a security report for the IT operations team that will be used to identify systems with outdated antivirus definitions. Which report layout is most effective?

   • AA narrative summary of antivirus update trends over the past month
   • BA table listing each system, its last antivirus update time, and a status column indicating if it is outdated
   • CA dashboard with multiple panels showing unrelated security metrics
   • DA pie chart showing the percentage of systems with outdated definitions
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You need to populate a report on failed authentication attempts across the organization. The report should include the source IP, username, and destination host for each failure. Which data source and fields are most appropriate?

   • ADNS logs, using fields like query, src_ip, and response
   • BFirewall logs, using fields like src_ip, dst_ip, and action
   • CWindows Event Logs, using fields like EventCode, User, and Computer
   • DAuthentication logs from the identity provider, using fields like src_ip, user, and dest_host
   Reveal Solution Discussion Select an answer first