Incident Detection with SIEM CSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is normalization important in a SIEM?

   • AIt reduces the size of logs by compressing them for storage efficiency
   • BIt converts raw logs into a common schema so that events from different sources can be compared and correlated
   • CIt removes all sensitive data from logs to comply with privacy regulations
   • DIt encrypts logs to prevent unauthorized access during transmission
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of 'pivoting' during a SIEM investigation?

   • ATo delete false positive alerts from the SIEM database
   • BTo rotate the encryption keys used for log transmission
   • CTo use an indicator from an alert (e.g., an IP address) to search for other related events across different log sources
   • DTo change the time zone of the SIEM server to match the log source
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst is triaging a queue of alerts. The organization has a critical financial database server and a less critical development server. The alerts are: (1) a failed login on the financial server, (2) a successful login from an unknown IP on the development server, (3) a malware signature match on a user workstation, and (4) a port scan from an internal IP. Which alert should be prioritized first?

   • AThe successful login from an unknown IP on the development server, because it is a successful event.
   • BThe failed login on the financial server, because it involves a critical asset.
   • CThe port scan from an internal IP, because it may indicate reconnaissance.
   • DThe malware signature match on the user workstation, because malware can spread to critical systems.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC manager wants to create a dashboard that shows the security posture of the organization. The dashboard should include the number of open alerts by severity, the top 10 attacked assets, and the average time to respond. However, the manager also wants to ensure that the dashboard is not overwhelming and provides actionable information. Which approach is best?

   • ACreate a dashboard that only shows the number of open alerts by severity, as that is the most important metric.
   • BCreate three separate dashboards, one for each metric, and link them together.
   • CCreate a single dashboard with multiple widgets: a bar chart for alerts by severity, a table for top attacked assets, and a line chart for average response time over time.
   • DCreate a dashboard with a single widget that shows a raw log feed of all alerts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When triaging SIEM alerts, which factor should be considered to prioritize which alert to investigate first?

   • AThe criticality of the affected asset
   • BThe time of day the alert was generated
   • CThe number of characters in the alert description
   • DThe color of the alert icon in the SIEM dashboard
   Reveal Solution Discussion Select an answer first