2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization ingests firewall logs, DNS logs, and endpoint detection alerts into its SIEM. The SIEM correlates events by source IP, destination IP, and timestamp, but the logs use different field names and timestamp formats. What should the analyst do first to enable effective correlation?

   • ACreate separate correlation rules for each log source to avoid conflicts
   • BStore the logs in their original format and rely on manual analysis
   • CEnrich the logs with threat intelligence before correlation
   • DNormalize the logs into a common schema with standardized field names and timestamp formats
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   A SIEM correlates a failed login event on a server with a subsequent successful login from the same source IP and then an outbound data transfer. What does this correlation help the analyst identify?

   • AA potential multi-step attack chain
   • BA hardware failure on the server
   • CA misconfigured firewall rule
   • DAn outdated antivirus signature
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst needs to collect authentication logs from 200 Windows servers and 50 Linux servers for centralized monitoring. The servers are in a mix of on-premises and cloud environments, and the analyst needs near-real-time log delivery with minimal configuration on each host. Which data collection method should the analyst choose?

   • AEnable NetFlow export on the network switches to capture authentication traffic
   • BUse SNMP traps to send authentication events from each server
   • CSchedule a nightly batch job to copy log files to a shared storage location
   • DDeploy a syslog agent on each server to forward logs to a central collector
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC manager wants to provide executives with a high-level view of security incidents over the past month. The executives need to understand trends without technical details. Which visualization is most appropriate?

   • AA packet capture analysis report
   • BA raw log table showing all events
   • CA correlation rule output listing matched events
   • DA dashboard with charts showing incident counts by severity and type over time
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial institution is required by regulation to retain transaction logs for seven years. The logs are stored in a SIEM that has limited storage capacity. The compliance team wants to ensure logs are available for audits, while the security team wants to keep the SIEM performance optimal. What should the organization do?

   • ACompress all logs and keep them in the SIEM for seven years
   • BDelete logs older than one year to free up SIEM storage
   • CArchive older logs to low-cost storage and keep recent logs in the SIEM for active analysis
   • DStore logs only in the SIEM and increase its storage capacity
   Reveal Solution Discussion Select an answer first