A SIEM is receiving logs from different vendors in various formats. The analyst wants to create a correlation rule that uses the source IP address from both Windows Event Logs and Linux syslog. What must be done to ensure the rule works correctly?

Convert all logs to a single format, such as syslog, before sending them to the SIEM.

Create separate rules for each log format and manually combine the results.

Ensure the logs are normalized into a common format so that the same field name is used for source IP in both log types.

Use the raw log format directly in the correlation rule and specify the vendor-specific field names.

Which approach is commonly used to scale a SIEM to handle increasing log volumes?

Deploying additional collectors and indexers in a distributed architecture

Reducing the number of log sources

Increasing the correlation rule threshold to reduce alerts

Adding more storage without changing processing capacity

Why is it important to regularly update correlation rules in a SIEM?

To improve the performance of the dashboard

To change the user interface layout

To reduce the storage space used by logs

To ensure the SIEM can detect new and evolving threats

A SIEM administrator is planning for a major expansion of log sources. The current SIEM is on-premises and uses a single server for collection, parsing, correlation, and storage. The administrator expects the data volume to triple. The budget is limited, and the administrator wants to minimize disruption. Which approach is most effective?

Move the SIEM to a cloud-based service to handle the increased volume.

Reduce the number of log sources to keep the volume manageable.

Replace the single server with a larger server that has more CPUs, memory, and disk space.

Separate the SIEM components onto multiple servers, starting with dedicated collectors and a dedicated correlation engine.

A SOC team has noticed that a new application server is not sending logs to the SIEM. The server was added to the network last week. Which routine administrative task should be performed to resolve this?

Increase the log retention policy for all existing sources.

Update the SIEM's user access permissions to allow the new server to log in.

Restart the SIEM correlation engine to force a rescan of the network.

Add the new server as a log source in the SIEM and verify that the appropriate agent or forwarding is configured.

EC-CouncilCertified SOC Analyst

Domain 3Objective 2

SIEM Deployment and Architecture CSA Practice Questions (Page 6)

Part of the Log Management and SIEM domain, which makes up ~13% of our current practice bank.

43questions here

9free pages

9concepts

Questions 26–30

26application · medium
A SIEM is receiving logs from different vendors in various formats. The analyst wants to create a correlation rule that uses the source IP address from both Windows Event Logs and Linux syslog. What must be done to ensure the rule works correctly?
Select an answer first
27foundation · easy
Which approach is commonly used to scale a SIEM to handle increasing log volumes?
Select an answer first
28foundation · easy
Why is it important to regularly update correlation rules in a SIEM?
Select an answer first
29expert · hard
A SIEM administrator is planning for a major expansion of log sources. The current SIEM is on-premises and uses a single server for collection, parsing, correlation, and storage. The administrator expects the data volume to triple. The budget is limited, and the administrator wants to minimize disruption. Which approach is most effective?
Select an answer first
30application · medium
A SOC team has noticed that a new application server is not sending logs to the SIEM. The server was added to the network last week. Which routine administrative task should be performed to resolve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.