SIEM Deployment and Architecture CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SIEM is receiving logs from multiple vendors, each with a different timestamp format and field names. The SOC wants to correlate events across these sources. What must be done to enable effective correlation?

   • ANormalize the logs into a common schema and parse the timestamps into a standard format.
   • BCreate separate correlation rules for each vendor's log format.
   • CDisable parsing for all sources to reduce processing overhead.
   • DStore the logs in their original format and use manual search queries for each vendor.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which strategy is used to ensure high availability of a SIEM by deploying multiple instances of critical components?

   • ANormalization
   • BParsing
   • CRedundancy
   • DAggregation
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC manager is designing a high-availability SIEM architecture. The SIEM must remain operational if a single component fails, and the team has a limited budget. The current architecture uses a single collector, a single correlation engine, and a single storage node. Which design provides the best balance of availability and cost?

   • ADeploy multiple collectors and a single correlation engine and storage node.
   • BDeploy two of each component (collector, correlation engine, storage) in an active-passive configuration.
   • CDeploy a single, more powerful server for all components to reduce the chance of failure.
   • DUse cloud-based SIEM with built-in redundancy, but only for non-critical logs.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC's SIEM is missing events during peak hours because the collector cannot keep up with the incoming log rate. The team has budget constraints and cannot add more collectors. The log sources include high-volume firewall logs and lower-volume authentication logs. Which optimization would best reduce the collector's load without losing critical security visibility?

   • AIncrease the logging verbosity of all sources to ensure no event is missed.
   • BMove all logs to cold storage and run correlation only on archived data.
   • CFilter out low-value firewall logs at the source and prioritize authentication logs for real-time processing.
   • DDisable the correlation engine during peak hours and re-enable it later.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During parsing of a raw log entry, which of the following is typically extracted as a field for analysis?

   • AThe storage retention period
   • BThe timestamp of the event
   • CThe SIEM's correlation rule ID
   • DThe dashboard widget configuration
   Reveal Solution Discussion Select an answer first