SIEM Deployment and Architecture CSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC analyst notices that a single failed login event is not alarming, but multiple failed logins across different hosts in a short time could indicate a brute-force attack. The SIEM receives logs from Active Directory, firewall, and endpoint protection. Which approach should the analyst take to detect this pattern?

   • AEnable verbose logging on all domain controllers to capture every authentication attempt.
   • BSet up a dashboard that displays all failed login events in real time and rely on manual monitoring.
   • CConfigure the firewall to block any IP that generates more than five failed logins in an hour.
   • DCreate a correlation rule that counts failed login events per source IP across multiple hosts within a 10-minute window and triggers an alert if the count exceeds a threshold.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which routine administrative task involves adding new log sources to the SIEM and ensuring they are sending data correctly?

   • ASystem health monitoring
   • BRule updates
   • CLog source management
   • DUser management
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network device only supports syslog for log export. The SIEM needs to parse the syslog messages to extract source IP and severity. What is the correct approach?

   • ASet up an API integration to fetch logs from the device.
   • BConfigure the device to send syslog to a SIEM collector and create a parsing rule to extract the required fields.
   • CInstall an agent on the network device to collect logs directly.
   • DUse a database connector to pull logs from the device's internal storage.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of a load balancer in a high-availability SIEM architecture?

   • ATo distribute incoming log traffic across multiple SIEM components
   • BTo parse log data into a common format
   • CTo correlate events across multiple sources
   • DTo store logs for long-term retention
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A startup wants to deploy a SIEM with minimal upfront cost and the ability to scale automatically as their log volume grows. They have no on-premises infrastructure. Which deployment model is most appropriate?

   • ACloud-based SIEM with a pay-as-you-go pricing model.
   • BCommunity cloud SIEM shared with other startups.
   • COn-premises SIEM using repurposed hardware.
   • DHybrid SIEM with on-premises collectors and cloud storage.
   Reveal Solution Discussion Select an answer first