QUESTION: 21

During a security incident, the security operations team identified sustained network traffic from a malicious IP address: 10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization’s network. Which of the following fulfills this request?

access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32

Answer(s): B

Reveal Solution Next Question

QUESTION: 22

A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary. Which of the following methods is most secure?

Implementing a bastion host
Deploying a perimeter network
Installing a WAF
Utilizing single sign-on

Answer(s): A

Reveal Solution Next Question

QUESTION: 23

A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee’s corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation. Which of the following logs should the analyst use as a data source?

Application
IPS/IDS
Network
Endpoint

Answer(s): D

Reveal Solution Next Question

QUESTION: 24

A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks.
SIEM alerts have not yet been configured. Which of the following best describes what the security analyst should do to identify this behavior?

Digital forensics
E-discovery
Incident response
Threat hunting

Answer(s): D

Reveal Solution Next Question

Free SY0-701 Exam Braindumps (page: 7)

QUESTION: 21

QUESTION: 22

QUESTION: 23

QUESTION: 24

SY0-701 Discussions & Posts