Incident Detection with SIEM CSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is proactive threat hunting in the context of SIEM?

   • AUpdating the SIEM software to the latest version
   • BSearching for indicators of compromise and suspicious behavior in the SIEM data before an alert is triggered
   • CConfiguring the SIEM to automatically block all suspicious IP addresses
   • DWaiting for alerts to be generated and then investigating them
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC analyst is performing proactive threat hunting. The analyst has a hypothesis that attackers are using PowerShell to download and execute payloads. The SIEM has logs from Windows Event Logs (including PowerShell logging), network proxy logs, and threat intelligence feeds. Which approach would be most effective to validate the hypothesis?

   • ASearch for PowerShell execution events that are followed by network connections to domains with low reputation scores, then review the associated command lines.
   • BCreate a correlation rule that alerts on any PowerShell execution and any low-reputation domain connection.
   • CSearch for all PowerShell events and manually review each one.
   • DSearch for network connections to low-reputation domains and then check if any PowerShell was used.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC manager wants to communicate the organization's security posture to executives. The manager needs to show the number of incidents by type, the average time to respond, and the percentage of alerts that were false positives. What is the best way to present this information?

   • ACreate a real-time dashboard with all raw alerts
   • BGenerate a weekly report with charts and summaries
   • CSend an email with the raw log data
   • DCreate a correlation rule that generates an alert for each metric
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC manager wants to create a report that shows the effectiveness of the SOC in detecting and responding to incidents. The report should include metrics such as the number of alerts, the number of false positives, the average time to respond, and the number of incidents escalated. Which approach is best?

   • ACreate a dashboard that shows these metrics in real-time and share the dashboard link with stakeholders.
   • BCreate a correlation rule that generates an alert when any of these metrics exceed a threshold.
   • CManually compile the metrics from the SIEM and email them to stakeholders each week.
   • DCreate a scheduled report that aggregates these metrics from the SIEM and distributes it to stakeholders on a weekly basis.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company has a mix of on-premises servers and cloud-based applications. The SOC wants to ingest logs from both environments into a single SIEM. What is the most important consideration when setting up log collection?

   • AUse the same log format for all sources
   • BConfigure the appropriate collection methods for each source (e.g., Syslog, API, agent)
   • CEnsure that all logs are sent to the SIEM in real-time
   • DStore all logs in a single index for simplicity
   Reveal Solution Discussion Select an answer first