SIEM Deployment and Architecture CSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC wants to detect a potential data exfiltration where a user uploads a large file to a cloud storage service. The SIEM has logs from the proxy, endpoint, and data loss prevention (DLP) system. Which correlation rule would best detect this?

   • AMonitor endpoint logs for unusual CPU usage during the upload.
   • BCorrelate a large outbound file transfer event from the proxy with a DLP alert for sensitive data.
   • CCreate a rule that triggers when a user logs in from a new device.
   • DAlert on any upload to a cloud storage service from the proxy logs alone.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A mid-sized company is deploying a SIEM and has a limited IT staff. They want to avoid managing physical hardware and need to scale quickly during peak periods. However, they have a regulatory requirement that log data must remain within the country's borders. Which deployment model best meets these needs?

   • ACloud-based SIEM in a region located within the required country.
   • BHybrid SIEM with collection on-premises and analysis in a foreign cloud region.
   • COn-premises SIEM with a dedicated server room.
   • DCommunity cloud SIEM shared with other organizations in the same industry.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company uses a SIEM and wants to improve detection of known malicious IP addresses and domains. They have a subscription to a commercial threat intelligence feed. Which integration approach is most effective?

   • AExport the threat intelligence feed to a CSV file and upload it to the SIEM monthly.
   • BManually add the threat intelligence indicators to the SIEM's watchlist once a week.
   • CConfigure the SIEM to automatically ingest the threat intelligence feed via API and use it in correlation rules.
   • DUse the threat intelligence feed only in the IDS/IPS and not in the SIEM.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does a SIEM typically integrate with an IDS/IPS to enhance detection?

   • ABy receiving alerts from the IDS/IPS and correlating them with other log data
   • BBy configuring the IDS/IPS to block all suspicious traffic automatically
   • CBy replacing the IDS/IPS with its own detection capabilities
   • DBy sending raw network packets to the IDS/IPS for analysis
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of log normalization in a SIEM?

   • ATo compress log data to reduce storage costs
   • BTo convert raw logs into a standard format with consistent field names and values
   • CTo encrypt logs to protect them in transit
   • DTo delete irrelevant log entries to reduce noise
   Reveal Solution Discussion Select an answer first