Incident Detection with SIEM CSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary role of a Security Information and Event Management (SIEM) system in an organization's security operations?

   • ATo replace the need for firewalls and intrusion detection systems by directly blocking malicious traffic
   • BTo store raw logs indefinitely without any analysis or alerting capabilities
   • CTo provide a graphical interface for manually reviewing each log entry one by one
   • DTo centralize log collection, correlate events across sources, and generate alerts for potential security incidents
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes how a SIEM contributes to incident detection?

   • AIt actively blocks malicious IP addresses at the network perimeter
   • BIt provides a secure tunnel for remote access to the corporate network
   • CIt replaces the need for endpoint protection by scanning files for malware
   • DIt aggregates and correlates logs from multiple sources to identify suspicious patterns and generate alerts
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization wants to detect a brute-force attack on its VPN gateway. The SOC analyst needs to create a correlation rule. Which condition should the rule use to minimize false positives while still detecting the attack?

   • AAlert when a successful login occurs after any failed login
   • BAlert when the total number of failed logins in a day exceeds 100
   • CAlert when the same source IP has more than 10 failed logins within 5 minutes
   • DAlert on any single failed VPN login
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC analyst is configuring the SIEM to improve detection of known malicious domains. The team has subscribed to a threat intelligence feed that provides domain reputation scores. Which integration approach would most effectively use this feed?

   • AImport the domain reputation list into the SIEM and create a correlation rule that alerts when a DNS query or network connection matches a domain with a reputation score above a threshold.
   • BManually check each suspicious domain against the threat intelligence feed during investigations.
   • CUse the threat intelligence feed to block all domains with a reputation score above a threshold at the firewall.
   • DStore the threat intelligence feed in a separate database and only reference it during manual hunting.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC analyst is investigating a potential compromise of a web server. The SIEM has logs from the web server, firewall, and threat intelligence feeds. The analyst has identified a suspicious IP that accessed a vulnerable endpoint. The analyst wants to determine if the same IP has been seen in other logs and if it is associated with any known malicious activity. Which approach is most effective?

   • ASearch the SIEM for all events involving the suspicious IP, pivot to related indicators such as user agents and file hashes, and cross-reference with threat intelligence feeds.
   • BCheck the threat intelligence feed for the IP and close the investigation if it is not listed.
   • CSearch only the web server logs for the IP and ignore other sources.
   • DCreate a correlation rule to alert on any future activity from the IP.
   Reveal Solution Discussion Select an answer first