Incident Detection with SIEM CSA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC team wants to reduce the number of false positives from a SIEM correlation rule that alerts on any connection to a domain that appears on a free threat intelligence list. The list is updated daily and contains many domains that are commonly used by legitimate ad networks. What is the best way to improve the rule's precision?

   • AChange the rule to alert only when the connection is from a non-standard port.
   • BIntegrate a curated threat intelligence feed with a higher confidence threshold and require the domain to be flagged by multiple sources.
   • CIncrease the risk score of the alert so it is prioritized higher in the queue.
   • DRemove the threat intelligence lookup from the rule and rely on behavioral analytics.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of a correlation rule in a SIEM?

   • ATo automatically patch vulnerabilities on affected systems
   • BTo generate a report of all log sources that are not sending data
   • CTo block malicious IP addresses at the firewall
   • DTo detect specific attack patterns by combining events from multiple sources based on defined conditions
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC analyst notices that a correlation rule designed to detect 'multiple failed logins followed by a successful login' is generating too many false positives. The rule currently triggers on 5 failed logins within 10 minutes followed by a successful login. Which adjustment is most likely to reduce false positives?

   • AChange the time window to 60 minutes while keeping the same threshold.
   • BIncrease the threshold to 10 failed logins within 10 minutes and require that the successful login occurs from a different source IP than the failed attempts.
   • CRemove the successful login condition and alert on any 5 failed logins.
   • DDecrease the threshold to 3 failed logins within 5 minutes.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is investigating a potential brute-force attack. The SIEM has ingested logs from a firewall, a Windows domain controller, and a Linux authentication server. Each source uses a different timestamp format and field naming convention. The analyst wants to correlate failed login attempts across all sources in a single query. What should the analyst do first?

   • ACreate separate queries for each log source and manually compare the results.
   • BUse the raw log search feature to find 'failed login' across all sources.
   • CConfigure the SIEM to store logs in their original format without any transformation.
   • DVerify that the SIEM has normalized the logs into a common schema with standardized fields such as 'src_ip', 'user', and 'timestamp'.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a 'use case' in the context of SIEM correlation rules?

   • AA hardware device that accelerates log processing
   • BA software license that allows the SIEM to be used for a specific number of users
   • CA type of log source that is supported by the SIEM
   • DA documented scenario that describes a specific threat or attack pattern that the SIEM should detect
   Reveal Solution Discussion Select an answer first