Log Management and Correlation CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC team is deploying a SIEM and wants to ensure that the correlation engine can handle the expected log volume. They have a mix of high-volume network logs and low-volume application logs. What is the best way to configure the correlation engine?

   • ADisable correlation for high-volume logs to save resources
   • BIncrease the log retention period to give the engine more time to process
   • CApply all correlation rules to all log sources equally
   • DApply different correlation rules to different log sources based on their volume and importance
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is required to retain logs for 2 years for compliance, but the SIEM only has storage for 6 months. The team is considering archiving logs to a low-cost storage solution. However, the compliance team requires that archived logs be searchable within 24 hours. What is the best approach?

   • AArchive logs to tape and store them offsite
   • BDelete logs after 6 months and rely on backups
   • CArchive logs to a low-cost storage solution that supports on-demand retrieval within 24 hours
   • DKeep all logs in the SIEM for 2 years by upgrading storage
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SIEM is receiving logs from multiple sources, but the same event appears in different formats: Windows Event ID 4625, Linux auth.log 'Failed password', and a firewall 'authentication failed' message. The SOC wants to correlate these events as failed logins. What is the first step the team should take?

   • AStore the logs in separate indexes and manually compare them during investigations.
   • BNormalize the logs into a common schema with a unified field like 'event_type: failed_login'.
   • CCreate a correlation rule that searches for the literal string 'failed login' in all logs.
   • DConfigure each source to send logs in the same format by editing the source applications.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst is investigating a potential insider threat. The analyst needs to correlate user activity across multiple systems. Which combination of log sources would provide the most complete picture?

   • ADHCP logs and routing logs
   • BAntivirus logs and patch management logs
   • CAuthentication logs, file access logs, and email logs
   • DFirewall logs and DNS logs only
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of log archival?

   • ATo delete logs that are no longer relevant
   • BTo make logs available for real-time analysis
   • CTo compress logs to reduce their size
   • DTo store logs that are no longer actively needed but must be retained for compliance or historical purposes
   Reveal Solution Discussion Select an answer first