Incident Detection with SIEM CSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst notices that the SIEM is generating a high volume of alerts for a rule that triggers on any outbound connection to a known-bad IP address. The rule is currently applied to all firewall logs. The analyst wants to reduce false positives while still detecting the malicious activity on critical assets. What should the analyst do?

   • AModify the rule to include a filter that excludes non-critical asset IP ranges and keep the alert severity high for critical assets.
   • BIncrease the alert threshold to require at least 10 outbound connections to the same IP before alerting.
   • CCreate a correlation rule that only triggers when the outbound connection is followed by a large data transfer within 5 minutes.
   • DDisable the rule and rely on manual review of firewall logs for any outbound connections to known-bad IPs.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an investigation, an analyst finds a suspicious file hash in an endpoint log. The analyst wants to determine if any other hosts in the environment have seen this file. Which SIEM capability should the analyst use?

   • ACreate a dashboard that shows the top files by frequency
   • BReview the correlation rule that generated the alert
   • CRun a query across all endpoint logs for the file hash
   • DCheck the threat intelligence feed for the hash
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC analyst is integrating a threat intelligence feed into the SIEM. The feed provides IP addresses, domains, and file hashes. The analyst wants to use this feed to enrich alerts and improve detection. However, the analyst is concerned about the volume of alerts generated by the feed. Which approach is best?

   • AImport the feed into the SIEM but do not use it in any rules or enrichment.
   • BCreate a correlation rule that triggers on any event that matches any indicator in the feed.
   • CUse the threat intelligence feed to enrich alerts rather than to trigger new alerts, and create correlation rules that use the enrichment data to add context.
   • DOnly use the feed for manual investigation, not for automated alerting.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC analyst is triaging an alert that indicates a possible data exfiltration from a file server. The alert was generated by a correlation rule that detected a large outbound transfer from the file server to an external IP. The file server contains sensitive customer data. The analyst has verified that the external IP is not on any threat intelligence list and that the transfer occurred during business hours. What should the analyst do?

   • AClose the alert as a false positive because the external IP is not on a threat intelligence list.
   • BEscalate the alert immediately because the file server contains sensitive data and any large outbound transfer is suspicious.
   • CInvestigate the user account associated with the transfer and check if the transfer is consistent with normal business activity, such as a large backup or a legitimate file share.
   • DBlock the external IP at the firewall immediately to prevent further data loss.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC manager wants a single view that shows the current number of open alerts by severity, the top 10 source IPs generating alerts, and the trend of alerts over the last 24 hours. What should the analyst build?

   • AA correlation rule that summarizes alert counts
   • BA dashboard with multiple panels for each visualization
   • CA threat intelligence feed that aggregates alert data
   • DA report that is emailed daily
   Reveal Solution Discussion Select an answer first