During an investigation, an analyst needs to determine whether a user installed unauthorized software on their workstation. Which log source would provide the most direct evidence?

Windows Event Log (e.g., Sysmon or AppLocker logs)

A SIEM is struggling to keep up with the volume of logs, causing delays in correlation. The team has already optimized the correlation rules. Which additional action would most effectively reduce the processing load?

Upgrade the SIEM's storage capacity.

Filter out low-value logs at the source or collector before they are sent to the SIEM.

Store all logs in raw format without parsing.

Increase the number of correlation rules to catch more events.

A SOC analyst is developing a use case to detect malware propagation within the network. Which correlation rule would be most effective?

Alert when a single host makes outbound connections to multiple internal hosts on port 445 within a short time.

Alert when a host receives an inbound connection on port 80.

Alert when any host makes an outbound connection to the internet.

Alert when a user logs in from a new device.

EC-CouncilCertified SOC Analyst

Domain 3Objective 1

Log Management and Correlation CSA Practice Questions (Page 1)

Part of the Log Management and SIEM domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

10concepts

Questions 1–5

1foundation · easy
Which correlation technique is best suited for detecting a brute-force attack where an attacker attempts many passwords in a short time?
Select an answer first
2application · medium
During an investigation, an analyst needs to determine whether a user installed unauthorized software on their workstation. Which log source would provide the most direct evidence?
Select an answer first
3expert · hard
A SIEM is struggling to keep up with the volume of logs, causing delays in correlation. The team has already optimized the correlation rules. Which additional action would most effectively reduce the processing load?
Select an answer first
4application · medium
A SOC analyst is developing a use case to detect malware propagation within the network. Which correlation rule would be most effective?
Select an answer first
5foundation · easy
Which method is commonly used to collect logs from network devices such as routers and switches?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Log Management and Correlation CSA Practice Questions (Page 1)

Questions 1–5

Which correlation technique is best suited for detecting a brute-force attack where an attacker attempts many passwords in a short time?

During an investigation, an analyst needs to determine whether a user installed unauthorized software on their workstation. Which log source would provide the most direct evidence?

A SIEM is struggling to keep up with the volume of logs, causing delays in correlation. The team has already optimized the correlation rules. Which additional action would most effectively reduce the processing load?

A SOC analyst is developing a use case to detect malware propagation within the network. Which correlation rule would be most effective?

Which method is commonly used to collect logs from network devices such as routers and switches?

Keep studying — Log Management and SIEM