Log Management and Correlation CSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is reviewing a correlation rule that triggers when 'a user logs in from a new location and then accesses a sensitive file.' The rule is meant to detect account compromise. Which correlation concept does this rule primarily use?

   • AAnomaly-based correlation that compares to a baseline of user behavior
   • BPattern-based correlation that links an authentication event to a subsequent access event
   • CThreshold-based correlation that counts the number of logins
   • DAggregation-based correlation that sums data from multiple sources
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a common challenge in log correlation that can lead to alert fatigue?

   • AHigh volume of false positives
   • BToo few logs being collected
   • CSlow network connections
   • DLack of storage space
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst wants to detect malware propagation within the network. The SIEM collects logs from endpoints, firewalls, and DNS servers. Which correlation use case would best detect this?

   • ACorrelate a firewall block event with a user visiting a website
   • BCorrelate high CPU usage on a server with a successful login
   • CCorrelate a single failed login on an endpoint with a DNS query
   • DCorrelate outbound connections from an infected host to multiple internal IPs on the same port
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC has a correlation rule that detects multiple failed logins followed by a successful login. The rule is generating many alerts for legitimate users who simply forgot their passwords. The team wants to reduce false positives without missing real brute-force attacks. Which adjustment is most appropriate?

   • AIncrease the number of failed logins required before the rule triggers.
   • BChange the rule to alert only when the successful login comes from a different country.
   • CDisable the rule and rely on manual log review.
   • DRemove the successful login condition and alert on any failed logins.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A multinational company has offices in three regions and wants to centralize logs into a single SIEM. The network links between regions have limited bandwidth, and the SIEM is in a central data center. The team needs to ensure logs are collected without overwhelming the WAN links. What is the best approach?

   • ASend all logs directly from each device to the central SIEM
   • BStore logs locally in each region and ship them to the SIEM once a month
   • CDeploy local collectors in each region that pre-process and compress logs before sending them to the central SIEM
   • DUse a VPN tunnel from each region to the central SIEM and send logs in real time
   Reveal Solution Discussion Select an answer first