Incident Detection with SIEM CSA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A SOC team is designing a correlation rule to detect data exfiltration. The rule currently alerts on any outbound transfer greater than 100 MB from any host. This generates many false positives because some hosts regularly transfer large files for legitimate business purposes. The team wants to reduce false positives while still detecting exfiltration from critical servers. Which approach is most effective?

   • AAdd a condition that the destination IP must be in a threat intelligence feed
   • BCreate separate rules for critical servers with a lower threshold and for other hosts with a higher threshold
   • CDisable the rule and rely on manual review of outbound traffic
   • DIncrease the threshold to 500 MB for all hosts
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company has a mix of on-premises servers and cloud-based applications. The SOC wants to centralize security logs from both environments into the SIEM. Which approach is most appropriate?

   • AManually export logs from the cloud and import them into the SIEM on a weekly basis.
   • BOnly collect logs from on-premises servers, as cloud logs are not relevant to security.
   • CUse a combination of on-premises log forwarders and cloud-native connectors to ingest logs from both environments into the SIEM.
   • DUse the same syslog forwarder for both on-premises and cloud logs without any adaptation.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary purpose of a SIEM dashboard?

   • ATo store raw log data for long-term archival
   • BTo replace the need for a ticketing system
   • CTo automatically patch vulnerabilities in the network
   • DTo provide a real-time visual overview of security events and indicators for monitoring
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   How does integrating threat intelligence feeds into a SIEM improve detection?

   • AIt encrypts all log data to prevent attackers from reading it
   • BIt allows the SIEM to compare incoming events against known indicators of compromise (IOCs) to identify malicious activity
   • CIt replaces the need for correlation rules by providing real-time blocking of threats
   • DIt automatically patches vulnerabilities on systems that match threat intelligence data
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A SOC team has a correlation rule that triggers on 'multiple failed logins followed by a successful login' for any account. The rule is generating a high number of false positives because users often mistype their passwords. The team wants to reduce false positives without missing real brute-force attacks. Which change is most effective?

   • ARequire that the successful login occurs from a different source IP than the failed attempts, and increase the failed login threshold to 10 within a 10-minute window.
   • BRemove the successful login condition and alert on any 5 failed logins.
   • CReduce the time window to 5 minutes and keep the threshold at 5 failed logins.
   • DExclude all known internal IPs from the rule.
   Reveal Solution Discussion Select an answer first