2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SIEM is receiving logs from a network device that sends timestamps in a non-standard format. The correlation team wants to use time-based rules. What must be done to ensure the timestamps are usable?

   • AIncrease the log retention period
   • BCreate a dashboard for the device logs
   • CConfigure timestamp parsing and normalization
   • DAdd a threat intelligence feed
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an incident investigation, an analyst finds an alert for a suspicious login. To determine the scope, the analyst needs to see all events from the same user and source IP across the past 72 hours. Which SIEM capability directly supports this?

   • ACorrelation rule creation
   • BPivot and drill-down search
   • CThreat intelligence enrichment
   • DDashboard reporting
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SIEM receives logs from a firewall (syslog), a Windows server (Event Log), and a cloud access log (JSON). The correlation team wants to write a single rule that checks for failed logins from any source. What must be configured first?

   • ADashboard creation for failed logins
   • BRetention policy adjustment
   • CThreat intelligence feed integration
   • DParsing and normalization rules for each source
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which factor is most important to consider when planning SIEM data retention?

   • AThe number of SIEM administrators
   • BThe color scheme of the dashboard
   • CThe brand of the firewall used
   • DCompliance requirements and storage costs
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is planning a SIEM deployment and must decide how long to retain log data. Regulatory requirements mandate 12 months of retention for authentication logs, but storage costs are a concern. Which approach balances compliance and cost?

   • AKeep all logs for only 6 months to save money
   • BConfigure tiered storage with hot storage for recent data and cold storage for older data, keeping authentication logs for 12 months
   • CRetain only authentication logs for 12 months and discard all other logs after 30 days
   • DStore all logs for 12 months in high-performance hot storage
   Reveal Solution Discussion Select an answer first