2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC analyst is triaging an alert that shows a host making outbound connections to a rarely used external IP. The IP is not in any threat intelligence feed. The analyst wants to determine if this is malicious without overwhelming the SIEM with false positives. The analyst has access to DNS logs, proxy logs, and endpoint process data. What is the best next step?

   • ABlock the IP address immediately to prevent potential malicious activity
   • BAdd the IP to a watchlist and wait for more alerts
   • CCorrelate the proxy logs with DNS logs to see what domain the IP resolved to and check endpoint process data for the process making the connection
   • DIncrease the SIEM's log retention to preserve more data
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SIEM analyst notices that firewall logs record source IP as 'src_ip', while VPN logs use 'SourceAddress'. The analyst wants to correlate login events across both sources. What is the most effective first step?

   • ANormalize both log types to a common schema, mapping both fields to a standard 'source_ip' field.
   • BEnrich the logs with threat intelligence before attempting correlation.
   • CStore the logs in separate indexes and manually compare them during investigations.
   • DCreate a correlation rule that matches on the raw field names.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is reviewing an alert that shows outbound traffic from an internal host to an external IP address. The alert was generated by the firewall, but the analyst needs to know if this IP address is known for malicious activity and whether the host has any other suspicious behavior. What should the analyst do to improve the investigation?

   • AIncrease the logging level on the firewall to capture more details
   • BStore the alert in a separate database for future reference
   • CNormalize the firewall alert to a standard format
   • DEnrich the alert with threat intelligence about the external IP and correlate with endpoint detection logs for the host
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A SIEM receives logs from a firewall, an endpoint, and a web server. Each source uses a different timestamp format and field naming convention. What process allows the SIEM to analyze these logs together?

   • AData aggregation
   • BData retention
   • CData encryption
   • DData normalization
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC is overwhelmed by false positives from a correlation rule that flags any internal host connecting to a known malicious IP. The analyst wants to reduce false positives while maintaining detection of real threats. Which enrichment should be added to the rule?

   • AAdd DNS resolution data for the external IP.
   • BAdd vulnerability scan data for the internal host.
   • CAdd asset criticality and user context to the rule.
   • DAdd geolocation data for the external IP.
   Reveal Solution Discussion Select an answer first