SIEM Deployment and Architecture CSA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a common performance tuning technique to reduce the processing load on a SIEM?

   • AFiltering out low-value log sources before ingestion
   • BIncreasing the number of dashboards
   • CStoring all logs in raw format without parsing
   • DDisabling all correlation rules
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational company is deploying a SIEM and must comply with data residency regulations that require certain log data to remain within the country of origin. The company also wants to centralize security monitoring. Which deployment model is most appropriate?

   • AA single cloud-based SIEM in a region that is not subject to data residency laws.
   • BA cloud-based SIEM with separate instances in each country, but no central monitoring.
   • CAn on-premises SIEM in the company's headquarters, with all logs sent there via VPN.
   • DA hybrid deployment with local collectors and storage in each country, forwarding only metadata to a central SIEM.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which SIEM component transforms raw log entries into a structured format with consistent field names and values so that events from different sources can be compared?

   • ACorrelation engine
   • BDashboard
   • CParser
   • DStorage
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SIEM administrator is updating correlation rules to address a new threat. After deploying the rules, the SOC notices that some legitimate events are being flagged as malicious. What is the best practice to avoid this issue in the future?

   • ADisable all existing rules when adding new ones.
   • BOnly update rules during off-peak hours.
   • CTest new rules in a staging environment with representative data before deploying to production.
   • DDeploy new rules immediately and monitor for false positives.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC manager is designing a SIEM architecture with high availability. The SIEM must be able to continue processing logs if one data center fails. The company has two data centers in different regions. Which architecture provides the best continuity?

   • ADeploy a single SIEM instance in one data center and use a third-party backup service for recovery.
   • BDeploy a single SIEM instance in one data center and replicate logs to the other data center for backup.
   • CDeploy active-active SIEM instances in both data centers, with load balancing and automatic failover.
   • DDeploy a SIEM instance in each data center, but only use one at a time and manually switch over.
   Reveal Solution Discussion Select an answer first