Incident Detection with SIEM CSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does the 'severity' of a SIEM alert indicate?

   • AThe number of log sources that generated the alert
   • BThe size of the log file that triggered the alert
   • CThe potential impact or urgency of the detected event
   • DThe physical location of the server that generated the log
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is triaging a queue of alerts. The alerts are: (1) a failed login on a domain controller, (2) a successful login from an unusual geographic location for a standard user, (3) a malware signature match on an isolated test server, and (4) a spike in outbound traffic from a database server that stores customer data. Which alert should the analyst prioritize first?

   • AThe spike in outbound traffic from the database server
   • BThe successful login from an unusual geographic location
   • CThe malware signature match on the isolated test server
   • DThe failed login on the domain controller
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is evaluating whether to deploy a SIEM solution. The company has a small IT team and a limited budget. The security team wants to centralize logs from firewalls, servers, and endpoints, and to receive alerts for suspicious activities. Which consideration is most important when choosing a SIEM?

   • AThe SIEM should have the most advanced machine learning features, even if they are not needed.
   • BThe SIEM should be deployed on-premises to ensure data privacy.
   • CThe SIEM should have the lowest possible cost, even if it lacks support for some log sources.
   • DThe SIEM should support the log sources the company has and provide pre-built correlation rules for common attack patterns.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst is reviewing the SIEM architecture for a mid-sized company that has recently deployed a next-generation firewall, an endpoint detection and response (EDR) tool, and a custom line-of-business application. The analyst needs to ensure that security events from all three sources are available for correlation and alerting. Which action is most appropriate to achieve this goal?

   • AConfigure the SIEM to receive syslog from the firewall, API-based ingestion from the EDR, and database or file-based ingestion from the application logs.
   • BInstall a syslog forwarder on the EDR server and configure the application to send logs via syslog to the SIEM.
   • CManually upload log files from each source to the SIEM on a daily basis.
   • DUse a single universal connector that ingests all logs in a raw format without parsing.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a common method for ingesting logs into a SIEM?

   • AInstalling an agent on the log source that forwards events to the SIEM collector
   • BUsing a firewall to block all inbound traffic to the SIEM server
   • CManually copying log files to the SIEM server via USB drives on a daily basis
   • DConfiguring the SIEM to actively scan the network for open ports and vulnerabilities
   Reveal Solution Discussion Select an answer first