2.17 Describe Use and Concepts of SIEM Tools for Security Data Analytics 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC analyst needs to quickly identify which alerts from the last 24 hours are critical and require immediate action. Which SIEM feature provides the most efficient way to prioritize?

   • AA threat intelligence feed update
   • BA raw log search for all events
   • CA correlation rule that generates more alerts
   • DA dashboard filtered by severity and status
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SIEM analyst notices that a correlation rule triggers hundreds of alerts per day for a known internal scanning tool. The alerts are consuming investigation time. Which action should the analyst take to reduce noise while preserving detection of genuine malicious scanning?

   • ADisable the correlation rule entirely
   • BDelete the internal scanning tool's logs from the SIEM
   • CIncrease the alert severity threshold so fewer alerts are generated
   • DAdd an exception for the internal scanning tool's source IP to the correlation rule
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   How does a SIEM support incident investigation?

   • ABy replacing the need for manual analysis
   • BBy deleting logs that are not relevant to the incident
   • CBy automatically containing infected endpoints
   • DBy allowing analysts to search and pivot across related events and logs
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SIEM analyst wants to prioritize alerts by correlating internal logs with known adversary infrastructure. The team has access to a commercial threat intelligence feed that updates hourly. What is the best way to use this feed in the SIEM?

   • AManually check each alert against the feed's website
   • BStore the feed in a spreadsheet and compare it to logs weekly
   • CIngest the feed as a reference set and use it in correlation rules to enrich and match events
   • DUse the feed only to create reports for management
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During an incident, an analyst needs to understand the full timeline of an attacker's activity, including initial access, lateral movement, and data exfiltration. The SIEM has logs from endpoints, firewalls, and authentication servers. Which investigation feature is most useful?

   • AGenerating a compliance report of all logins
   • BCreating a new correlation rule to detect the attack after the fact
   • CConstructing a timeline view that aggregates related events across all sources
   • DDeleting duplicate events to reduce noise
   Reveal Solution Discussion Select an answer first