SIEM Deployment and Architecture CSA Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   What is a primary advantage of a cloud-based SIEM deployment over an on-premises deployment?

   • AIt eliminates the need for internet connectivity
   • BIt guarantees data residency in a specific country
   • CIt provides full control over the underlying hardware
   • DIt reduces the need for upfront hardware investment and allows rapid scaling
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A SIEM administrator needs to collect logs from a cloud-based SaaS application that provides a RESTful API for exporting audit logs. Which collection method is best suited for this task?

   • ADatabase connector
   • BAgent-based collection
   • CAPI connector
   • DSyslog
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A SIEM analyst is creating a correlation rule that depends on the 'user' field extracted from logs. The analyst notices that the 'user' field is sometimes empty or contains different formats (e.g., 'domain\user' vs 'user@domain.com'). What is the best practice to ensure the correlation rule works reliably?

   • ANormalize the user field to a standard format during parsing, and handle empty values in the correlation rule.
   • BCreate multiple correlation rules, one for each format of the user field.
   • CIgnore events where the user field is empty to reduce noise.
   • DUse the raw log message in the correlation rule and search for the user string.
   Reveal Solution Discussion Select an answer first