Incident Detection with SIEM CSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is an example of a threat intelligence indicator that can be integrated into a SIEM?

   • AA list of internal employee names
   • BA list of known malicious IP addresses
   • CA list of standard TCP ports
   • DA list of approved software vendors
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is evaluating whether to deploy a SIEM. The security team's main goal is to detect an attack that spans multiple systems, such as a user clicking a malicious link, the malware downloading a payload, and then the payload communicating with a C2 server. Which SIEM feature is most important for this goal?

   • ACorrelation engine
   • BCentralized log storage
   • CThreat intelligence integration
   • DUser-friendly dashboard
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC analyst is triaging an alert that was generated by a correlation rule. The rule triggered on a single failed login from an external IP to a domain controller, followed by a successful login from the same IP 5 minutes later. The domain controller is a critical asset. However, the analyst notices that the successful login was from a known VPN gateway IP, and the user is a remote employee who frequently works from home. What should the analyst do?

   • AEscalate the alert immediately because the domain controller is critical and any successful login from an external IP is suspicious.
   • BInvestigate the user's recent activity and verify the successful login with the user or through additional logs before closing the alert.
   • CModify the correlation rule to exclude all VPN gateway IPs from triggering alerts.
   • DClose the alert as a false positive because the successful login came from the VPN gateway.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of parsing in a SIEM?

   • ATo delete duplicate log entries to reduce storage usage
   • BTo extract individual fields from raw log messages so they can be stored in a structured format
   • CTo generate a human-readable summary of all log entries
   • DTo assign a severity score to each log event
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC manager wants a daily overview of the number of security alerts by severity, the top attacked assets, and the average time to respond. Which SIEM feature should be used to present this information to management?

   • ACreate a dashboard with widgets for alert counts by severity, top attacked assets, and average response time.
   • BConfigure a correlation rule to alert on any alert volume increase.
   • CGenerate a raw log export and send it to management via email.
   • DUse the SIEM's search function to manually count alerts each day.
   Reveal Solution Discussion Select an answer first