Incident Detection with SIEM CSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A threat hunter wants to find any host that has communicated with a newly discovered malicious domain. The domain is not yet in the SIEM's threat intelligence feed. What is the most efficient way to search for this indicator?

   • ACreate a new correlation rule that alerts on any DNS query
   • BRun a SIEM query that searches DNS logs for the domain name
   • CCheck the firewall logs for connections to the domain's IP address
   • DWait for the threat intelligence feed to update and then run a search
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a common log source that provides information about network traffic and blocked connections?

   • AFirewall logs
   • BAuthentication logs from a domain controller
   • CApplication logs from a web server
   • DDNS server logs
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company ingests logs from multiple firewall vendors into its SIEM. The analyst wants to search for all outbound connections to a specific IP address across all firewalls. The raw logs have different field names (e.g., 'dst_ip', 'dest_addr', 'destination'). What is the most efficient way to enable a single search across all logs?

   • ACreate a separate dashboard for each firewall vendor and manually compare results.
   • BConfigure the SIEM to parse and normalize the logs into a common schema with a standard field name like 'destination_ip'.
   • CUse a regex query that matches any of the possible field names in the raw logs.
   • DStore the raw logs in a separate index and search each index individually.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During an investigation, an analyst finds a suspicious IP address in a firewall log that communicated with an internal server. The analyst wants to determine if any other internal hosts communicated with that IP and if any malware signatures were triggered. Which SIEM capability should the analyst use?

   • ACreate a new correlation rule that alerts on any traffic to that IP.
   • BUse the search function to query all logs for the suspicious IP and pivot to related indicators such as malware signatures.
   • CManually review each log source separately without using the SIEM search.
   • DCheck the SIEM dashboard for a pre-built report on suspicious IPs.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A small company has separate logs from its firewall, antivirus, and Windows servers. The security team wants to detect a multi-stage attack that involves a malicious download, a connection to a command-and-control server, and then lateral movement. What is the primary reason to use a SIEM for this detection?

   • ATo replace the firewall and antivirus systems
   • BTo correlate events across different log sources to identify the attack chain
   • CTo provide a user-friendly interface for manual log review
   • DTo store logs in a central repository for compliance purposes
   Reveal Solution Discussion Select an answer first