CAS-004 practice question 1 of 35
During a review of events, a security analyst notes that several log entries from the FIM system identify changes to firewall rule sets. While…
Full set: 610 questionsDuring a review of events, a security analyst notes that several log entries from the FIM system
identify changes to firewall rule sets. While coordinating a response to the FIM entries, the analyst
receives alerts from the DLP system that indicate an employee is sending sensitive data to an
external email address. Which of the following would be the most relevant to review in order to gain
a better understanding of whether these events are associated with an attack?
Correct Answer:
E. NetFlow logs
Explanation
NetFlow logs provide visibility into network traffic patterns and volume, which can be analyzed to detect anomalies, including potential security incidents. They can be invaluable in correlating the timing and nature of network events with security incidents to better understand if there is an association.
Keep practicing
Take the free CAS-004 practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CAS-004 practice questions
- Question 2A security engineer is performing a threat modeling procedure against a machine learning …
- Question 3Which of the following security features do email signatures provide?
- Question 4A security analyst is examining a former employee's laptop for suspected evidence of susp…
- Question 6An IT director is working on a solution to meet the challenge of remotely managing laptop…
- Question 7Which of the following is the reason why security engineers often cannot upgrade the secu…
- Question 8Which of the following provides the best solution for organizations that want to securely…