2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SIEM analyst is tuning a correlation rule that alerts on failed logins followed by a successful login. The rule generates many false positives due to users mistyping passwords. The analyst wants to reduce false positives without missing real brute-force attacks. Which tuning approach is most effective?

   • ADisable the rule and rely on threat intelligence feeds for brute-force detection
   • BAdd a longer time window to the rule
   • CChange the rule to alert on any successful login after any failed login
   • DIncrease the threshold of failed logins required before a successful login triggers the alert
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does integrating threat intelligence feeds improve a SIEM's detection capability?

   • ABy replacing the need for correlation rules
   • BBy encrypting all log data in transit
   • CBy automatically blocking all traffic from suspicious IP addresses
   • DBy enriching events with indicators of compromise such as known malicious IPs and domains
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center (SOC) ingests firewall syslog, Windows Event Logs, and NetFlow into its SIEM. Analysts notice that the same source IP appears in a firewall deny log and a Windows logon failure event, but the SIEM does not correlate them because the IP is stored in different fields. Which SIEM capability should the team verify is correctly configured to enable this correlation?

   • ALog retention policy settings
   • BField normalization mapping to a common schema
   • CThreat intelligence feed enrichment
   • DDashboard visualization widgets
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is deploying a SIEM and must decide whether to collect all logs from all sources or only security-relevant logs. The security team wants maximum visibility, but the budget limits storage and processing. Which approach balances visibility with cost?

   • ACollect only security-relevant logs from critical systems
   • BCollect all logs and store them uncompressed
   • CCollect all logs but apply filtering and aggregation rules to reduce noise
   • DCollect only alerts from other security tools
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SIEM correlation rule alerts on 'multiple failed logins followed by a successful login' within 10 minutes. The SOC is overwhelmed by alerts from a single user who frequently forgets their password. The user is a known developer with legitimate access. Which tuning approach best reduces alert fatigue without losing detection of actual brute-force attacks?

   • ACreate an exception for this specific user account
   • BShorten the time window to 5 minutes
   • CDisable the rule entirely
   • DIncrease the failed login threshold to 20
   Reveal Solution Discussion Select an answer first