Incident Detection with SIEM CSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC team wants to enrich their SIEM alerts with threat intelligence data to provide context about the attacker. They have access to a commercial threat intelligence feed and an open-source feed. What is the best way to use these feeds?

   • AStore the feeds in a spreadsheet and manually check alerts against them.
   • BUse only the commercial feed because it is more reliable.
   • CUse only the open-source feed to save costs.
   • DIntegrate both feeds into the SIEM and use them to enrich alerts with reputation scores and context.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is deploying a new SIEM. The SOC team has identified the following log sources: firewall, IDS/IPS, Windows servers, Linux servers, and cloud-based SaaS applications. The team is concerned about the volume of logs and the cost of storage. Which strategy would best balance log retention and cost?

   • ACollect all logs at the highest verbosity and store them for the maximum retention period.
   • BCollect only firewall logs because they are the most important.
   • CPrioritize log sources based on criticality and regulatory requirements, and configure tiered storage with shorter retention for less critical logs.
   • DUse a log management tool that stores logs in raw format without indexing.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why are SIEM reports important for security operations?

   • AThey replace the need for log storage
   • BThey provide a documented record of security events and metrics that can be shared with management and stakeholders
   • CThey are used to configure correlation rules
   • DThey automatically block malicious traffic based on the report contents
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SIEM is receiving logs from a custom application that uses a non-standard log format. The analyst wants to search for a specific user ID in the logs. What must be done first to make the user ID searchable?

   • AUse a regex query to search the raw logs
   • BConfigure a parser to extract the user ID into a standard field
   • CCreate a correlation rule that references the user ID
   • DStore the logs in a separate index for the application
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is investigating an alert that was triggered by a SIEM rule that checks outbound connections against a threat intelligence feed. The alert shows a connection to an IP address that is listed as a C2 server. However, the analyst discovers that the IP address is a cloud provider's shared IP used by many legitimate customers. What should the analyst do?

   • ACheck the SIEM for other events from the same source IP to see if there is additional suspicious activity
   • BEscalate the alert to a senior analyst for further investigation
   • CUpdate the threat intelligence feed to remove the IP address
   • DClose the alert as a false positive and disable the rule
   Reveal Solution Discussion Select an answer first