SIEM and SOAR CSE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which method is commonly used by a SIEM to collect logs from cloud-based services?

   • AUsing APIs provided by the cloud service to pull log data
   • BManually copying log files via USB drives
   • CReading logs directly from the cloud provider's physical servers
   • DInstalling a kernel module on the hypervisor
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why does a SIEM normalize log data from different sources?

   • ATo delete duplicate log entries automatically
   • BTo convert logs into a common format so they can be compared and analyzed together
   • CTo encrypt the logs so they cannot be read by unauthorized users
   • DTo reduce the storage size of the logs
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a key benefit of integrating SIEM with SOAR?

   • AIt eliminates the need for security analysts
   • BIt automatically patches all software vulnerabilities
   • CIt reduces the time between detection and response
   • DIt guarantees that no security incidents will occur
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During an incident, the response team needs to contain a compromised server. The server is running critical business applications, and taking it offline will cause significant downtime. The team has a SOAR platform that can isolate the server from the network. What is the best course of action?

   • ALeave the server online to avoid downtime, and monitor it closely
   • BUse the SOAR playbook to isolate the server, but first notify the business owner and get approval if time permits
   • CDisconnect the server from the internet but keep it on the internal network
   • DIsolate the server immediately to prevent further compromise, then assess the business impact
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SIEM detects a potential ransomware outbreak and creates an alert. The security team wants the alert to automatically trigger containment actions, such as isolating affected endpoints, without waiting for a human analyst. Which integration capability is required?

   • ASIEM sends the alert to a SOAR platform, which executes a containment playbook
   • BSecurity analysts manually copy the alert details into a ticketing system
   • CEndpoint protection software automatically updates its virus definitions
   • DSIEM directly modifies firewall rules to block the ransomware command-and-control IP
   Reveal Solution Discussion Select an answer first