Log Management and Correlation CSA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC team is experiencing a high volume of alerts from a correlation rule that detects 'multiple failed logins followed by a successful login.' The rule is generating too many false positives because of a known application that retries authentication. The team wants to maintain detection of real brute-force attacks. What is the best approach?

   • ACreate a suppression list for the known application's service account and keep the rule active for other accounts
   • BDisable the rule entirely
   • CChange the rule to trigger on any failed login
   • DIncrease the threshold to 50 failed logins
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC team has deployed a correlation rule that triggers on 'multiple failed logins followed by a successful login.' The rule is generating too many false positives because legitimate users often forget their passwords. What is the best way to reduce false positives while still detecting brute force?

   • ADisable the rule during business hours
   • BRemove the successful login condition from the rule
   • CIncrease the threshold for failed logins and add a time window constraint
   • DAdd more log sources to the rule to increase the data
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In the context of security operations, what is the primary purpose of log management?

   • ATo collect, store, and analyze log data to support security monitoring, incident response, and compliance
   • BTo store logs indefinitely for forensic investigations
   • CTo delete logs that are no longer needed to reduce storage costs
   • DTo generate logs from all systems in the organization
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which best practice helps improve the accuracy of correlation rules and reduce false positives?

   • ATuning rules based on the organization's environment and known false positives
   • BDisabling all correlation rules to avoid false positives
   • CUsing broad correlation rules that match many events
   • DIncreasing the time window for all rules
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC team has a correlation rule that triggers on '10 failed logins from the same source IP within 5 minutes.' The rule is generating many false positives because a NAT gateway causes many users to share the same public IP. The team wants to reduce false positives while still detecting brute force. What is the best approach?

   • AChange the rule to correlate failed logins by username instead of source IP
   • BIncrease the threshold to 20 failed logins within 5 minutes
   • CDisable the rule and rely on manual monitoring
   • DAdd a condition that the source IP must be external
   Reveal Solution Discussion Select an answer first