Log Management and Correlation CSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of log normalization in a SIEM environment?

   • ATo convert raw logs into a consistent, structured format for efficient analysis
   • BTo compress log files to save storage space
   • CTo delete irrelevant log entries to reduce noise
   • DTo encrypt logs to protect them from unauthorized access
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A newly deployed correlation rule is generating hundreds of alerts per day, most of which are false positives. The SOC team is overwhelmed. What is the most effective first step to improve the rule's precision?

   • AIncrease the severity of the alerts so analysts pay more attention.
   • BDisable the rule entirely to stop the alerts.
   • CAdjust the rule's threshold or add additional conditions to reduce noise.
   • DAdd more log sources to the rule to increase the data volume.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC is centralizing logs from remote branch offices with limited bandwidth. The SIEM is in a central data center. The team needs to ensure logs are not lost during network outages and that bandwidth usage is minimized. Which collection strategy best meets these conflicting requirements?

   • ADeploy local collectors at each branch that buffer logs locally and forward them in batches over a compressed channel.
   • BStream logs directly from each source to the SIEM over the WAN in real time.
   • CHave each branch store logs locally and only send them to the SIEM once per month.
   • DUse a VPN tunnel and send all logs without compression to ensure integrity.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial company must retain audit logs for at least 7 years to meet regulatory requirements. The SIEM's hot storage is expensive and limited. The company wants to keep recent logs easily searchable while preserving older logs for compliance. Which strategy best meets these needs?

   • AArchive logs to tape and never index them, making retrieval manual.
   • BKeep logs in hot storage for 90 days, then move them to low-cost archival storage for the remaining 7 years.
   • CDelete logs after 90 days to reduce storage costs.
   • DStore all logs in hot storage for 7 years to ensure immediate searchability.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SIEM is receiving logs from a custom application that uses a non-standard timestamp format. The analyst wants to ensure the SIEM can correlate these logs with other sources. What is the most important step?

   • AStore the logs as-is and rely on manual review
   • BAsk the application vendor to change the log format
   • CCreate a parser that extracts and converts the timestamp to a standard format
   • DIgnore the timestamp and use the SIEM's ingestion time
   Reveal Solution Discussion Select an answer first