SIEM Deployment and Architecture CSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the benefit of integrating threat intelligence feeds into a SIEM?

   • AIt allows the SIEM to automatically patch vulnerabilities
   • BIt enriches events with known indicators of compromise (IOCs) to improve detection
   • CIt encrypts all log data in transit
   • DIt replaces the need for correlation rules
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is deploying a SIEM and needs to collect logs from a cloud-based SaaS application that provides an API for exporting audit logs. The company wants to minimize the impact on the SaaS application's performance and avoid storing logs locally. Which collection method is most appropriate?

   • AHave the SaaS application export logs to a shared storage location and then manually upload them to the SIEM.
   • BUse the SaaS application's API to periodically pull audit logs and forward them directly to the SIEM.
   • CConfigure the SaaS application to send syslog to the SIEM's collector.
   • DInstall a SIEM agent on the SaaS application's servers to collect logs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SIEM administrator is troubleshooting why events from a network device are not appearing in the SIEM dashboard. The device is configured to send syslog to the SIEM's collector. The collector is receiving the logs, but they are not being parsed correctly. Which component is most likely causing the issue?

   • AThe dashboard is not configured to display events from that source.
   • BThe parser is not correctly extracting fields from the raw syslog messages.
   • CThe correlation engine is not processing the logs because they are not normalized.
   • DThe storage component is full and cannot store new events.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which SIEM deployment model is characterized by the organization managing the entire infrastructure on its own premises, providing full control over data and hardware?

   • AManaged security service provider (MSSP)
   • BOn-premises
   • CCloud-based
   • DHybrid
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A financial institution is evaluating SIEM deployment models. They have strict data sovereignty requirements that prohibit log data from leaving the country. They also need to handle unpredictable spikes in log volume during attacks. Their IT team is small and lacks deep SIEM administration expertise. Which deployment model is the best trade-off?

   • ACloud-based SIEM deployed in a region within the country, with a managed service provider for administration.
   • BHybrid SIEM with on-premises collectors and cloud analysis in a foreign region.
   • COn-premises SIEM with a dedicated team of administrators.
   • DCommunity cloud SIEM shared with other financial institutions in the same country.
   Reveal Solution Discussion Select an answer first