2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which challenge does log normalization address in a SIEM deployment?

   • ADifferent devices use different log formats and field names for the same event
   • BLack of storage capacity for long-term retention
   • CAuthentication of log sources
   • DNetwork bandwidth limitations for log transmission
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a common data source ingested by a SIEM tool?

   • ARouter configuration files
   • BDNS zone transfer data
   • CWindows Event Logs
   • DEncrypted password hashes
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company is deploying a SIEM and must ingest logs from multiple regional offices with limited WAN bandwidth. The SIEM must still provide centralized correlation and alerting. Which deployment approach best addresses the bandwidth constraint?

   • AUse a cloud-based SIEM without any on-premises components
   • BStore logs locally at each site and only forward alerts
   • CSend all raw logs directly from every device to the central SIEM over the WAN
   • DDeploy log collectors at each site that filter and forward only relevant events to the central SIEM
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which SIEM feature is most useful for an analyst investigating a potential breach?

   • AThe ability to generate a new encryption key for the network
   • BThe ability to automatically block the IP address at the firewall
   • CThe ability to compress logs to save storage
   • DThe ability to pivot from an alert to view all events associated with a specific IP address
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A SIEM administrator is configuring a new data source that produces logs in a proprietary format. The security team wants these logs to be searchable alongside existing sources and included in correlation rules. What must the administrator do first?

   • ADefine a parsing and normalization policy for the proprietary format
   • BCreate a correlation rule that references the proprietary field names
   • CEnable threat intelligence enrichment for the new source
   • DIncrease the log retention period for the new source
   Reveal Solution Discussion Select an answer first