2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization's SIEM receives NetFlow data and Windows Event Logs. The security team wants to identify connections to known malicious IP addresses from the latest threat intelligence feed. Which SIEM feature should they use to accomplish this?

   • AIncrease the retention period for NetFlow data to ensure the feed can be applied later
   • BUse a reporting tool to export logs and run the threat feed comparison outside the SIEM
   • CConfigure a dashboard that displays all NetFlow traffic and manually compare it to the feed
   • DEnrich NetFlow and event logs with threat intelligence indicators and create a correlation rule that alerts on matches
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager asks the SIEM analyst to provide a weekly summary of the top attack types and affected systems to share with non-technical executives. Which SIEM feature should the analyst use to produce this deliverable efficiently?

   • ACreate a scheduled report that aggregates alert data by attack type and affected asset
   • BConfigure a real-time dashboard and share the live link with executives
   • CExport raw logs to a spreadsheet and email them
   • DRun an ad-hoc search each week and manually compile the results
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement best describes the primary purpose of a SIEM tool?

   • ATo automatically patch vulnerabilities across the network
   • BTo provide a secure channel for remote administration of network devices
   • CTo aggregate and analyze security data from multiple sources to detect and respond to threats
   • DTo replace the need for endpoint protection platforms
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which scenario best illustrates a SIEM correlation rule detecting an incident?

   • AAlerting when a single firewall log shows a denied outbound connection
   • BAlerting when multiple failed logins from one source are followed by a successful login from a different country
   • CAlerting when a server generates a high CPU usage event
   • DAlerting when a user changes their password
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC manager wants to measure the effectiveness of the SIEM detection rules. The team has a large number of alerts, but it is unclear how many are true positives. Which approach provides the most meaningful metric?

   • ATrack the number of alerts that are confirmed as incidents after investigation and calculate a true-positive rate
   • BCount the total number of alerts generated per day
   • CMeasure the SIEM's storage usage over time
   • DReport the number of dashboards created
   Reveal Solution Discussion Select an answer first