SYO 701 SOC - SIEM - INCIDENT RESPONSE Module FC

Front

4. 4. A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis. Which of the following types of controls is the company setting up?

Back

C. Detective

Front

8. 8. A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file's creator. Which of the following actions would most likely give the security analyst the information required?

Back

D. Query the file's metadata

Front

12. 12. A company's public-facing website, https://www.organization.com, has an IP address of 166.18.75.6. However, over the past hour the SOC has received reports of the site's homepage displaying incorrect information. A quick nslookup search shows https://www.organization.com is pointing to 151.191.122.115. Which of the following is occurring?

Back

C. DNS spoofing

Front

14. 14. A security manager created new documentation to use in response to various types of security incidents. Which of the following is the next step the manager should take?

Back

D. Conduct a tabletop exercise with the team.

Front

15. 15. A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server. Which of the following best describes what the security analyst is seeing?

Back

D. Reflected denial of service

Front

46. During an investigation, an incident response team attempts to understand the source of an incident. Which of the following incident response activities describes this process?

Back

A. Analysis

Front

48. 48. Which of the following incident response activities ensures evidence is properly handied?

Back

B. Chain of custody

Front

49. A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks. SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?

Back

D. Threat hunting

Front

71. 71. A security analyst reviews domain activity logs and notices the following:

Back

C. An attacker is attempting to brute force smith's account.

Front

75. 75. An administrator is reviewing a single server's security logs and discovers the following;

Which of the following best describes the action captured in this log file?

Back

A. Brute-force attack