Log Management and Correlation CSA Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   A SOC analyst notices that the SIEM is generating many false positives because the same event is logged in different formats by different devices. The analyst wants to ensure that all logs are stored in a consistent format for correlation. What should the analyst do?

   • ADisable logging on devices that produce inconsistent formats
   • BIncrease the correlation rule thresholds to reduce the number of alerts
   • CManually review each log entry and adjust the correlation rules accordingly
   • DCreate a parsing and normalization policy that maps raw log fields to a common schema
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A SOC team has a correlation rule that triggers on 'a user logging in from a new geolocation.' The rule is generating false positives because users travel frequently. The team wants to detect account compromise without annoying alerts. What is the best approach?

   • ARemove the geolocation rule entirely
   • BAdd a condition that the login must occur within a short time after a previous login from a different location
   • COnly trigger the rule for users in the IT department
   • DIncrease the threshold to require multiple new locations in one day
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   What is the primary benefit of aggregating logs from multiple sources into a centralized repository?

   • AIt reduces the storage space required for logs
   • BIt automatically normalizes all logs into a single format
   • CIt eliminates the need for log retention policies
   • DIt enables comprehensive analysis and correlation of events across the entire IT environment
   Reveal Solution Discussion Select an answer first