SIEM Deployment and Architecture CSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a typical SIEM architecture, which component is responsible for ingesting raw log data from various sources and forwarding it to the processing pipeline?

   • ADashboard
   • BParser
   • CCollector
   • DCorrelation engine
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SIEM administrator is reviewing the correlation rules and notices that a rule has generated a high number of false positives. The rule was designed to detect suspicious PowerShell activity. The administrator wants to reduce false positives without missing real threats. Which action is most appropriate?

   • ADisable the rule entirely to stop the false positives.
   • BChange the rule to trigger only on PowerShell execution from a specific user account.
   • CIncrease the severity of the rule to make the alerts more visible.
   • DRefine the rule by adding additional conditions, such as excluding known administrative scripts or requiring specific command-line patterns.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC administrator is responsible for maintaining the SIEM. The administrator notices that some log sources are no longer sending data, and the SIEM dashboard shows a decrease in events. What is the first step the administrator should take?

   • ACheck the health and status of the log sources and the SIEM's collection components.
   • BDisable the inactive log sources to reduce noise in the SIEM.
   • CReboot the SIEM server to refresh the log collection services.
   • DIncrease the log collection frequency to ensure more data is received.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC relies on a single SIEM collector that ingests all firewall logs. The collector fails, and the SOC is blind to firewall activity for several hours. To prevent this single point of failure, what should be implemented?

   • AConfigure the firewall to send logs directly to the correlation engine.
   • BIncrease the log retention period on the firewall.
   • CSchedule daily backups of the collector's configuration.
   • DDeploy a second collector in active-passive mode with automatic failover.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SIEM architecture is being designed for a large enterprise. The team wants to ensure that log collection continues even if the central correlation engine fails. Which component should be designed with redundancy?

   • AThe message queue or broker that buffers logs between collectors and the correlation engine.
   • BThe user authentication database for the SIEM console.
   • CThe report generation module that creates daily summaries.
   • DThe dashboard server that displays alerts to analysts.
   Reveal Solution Discussion Select an answer first