What is the primary purpose of log correlation in a SIEM?

To generate reports for management

To reduce the volume of logs stored

To normalize logs into a common format

To identify relationships between disparate log events to detect potential security threats

When configuring a correlation rule in a SIEM, what is the typical purpose of setting a time window?

To define the period within which events must occur for the rule to trigger

To specify how long the SIEM should take to process the rule

To determine how long alerts will remain active

To set the retention period for the logs used by the rule

Which sequence correctly represents the log lifecycle in a typical log management process?

Generation, Collection, Normalization, Storage, Analysis, Archival

Generation, Normalization, Collection, Storage, Archival, Analysis

Generation, Storage, Collection, Analysis, Archival, Normalization

Collection, Generation, Storage, Analysis, Archival, Normalization

A SOC wants to detect a user account that has been compromised and is being used to access multiple systems. The SIEM has authentication logs from all systems. Which correlation rule technique would be most effective?

A rule that triggers when a user logs in from a different geographic location

An anomaly rule that triggers when a user logs in from a new IP address

A pattern rule that triggers when the same user account logs into multiple systems within a short time

A threshold rule that triggers when a user logs in more than 10 times in a day

What is the role of a correlation engine in a SIEM platform?

To process and analyze normalized logs to identify patterns and generate alerts

To collect logs from various sources

To store logs in a centralized database

To provide a user interface for analysts

EC-CouncilCertified SOC Analyst

Domain 3Objective 1

Log Management and Correlation CSA Practice Questions (Page 5)

Part of the Log Management and SIEM domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

10concepts

Questions 21–25

21foundation · easy
What is the primary purpose of log correlation in a SIEM?
Select an answer first
22foundation · easy
When configuring a correlation rule in a SIEM, what is the typical purpose of setting a time window?
Select an answer first
23foundation · easy
Which sequence correctly represents the log lifecycle in a typical log management process?
Select an answer first
24application · medium
A SOC wants to detect a user account that has been compromised and is being used to access multiple systems. The SIEM has authentication logs from all systems. Which correlation rule technique would be most effective?
Select an answer first
25foundation · easy
What is the role of a correlation engine in a SIEM platform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.