SIEM and SOAR CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices that the SIEM generates an alert every time a user fails to log in twice within five minutes. The organization has many users who mistype passwords, causing a high volume of false positives. What is the best way to reduce the noise while still detecting brute-force attacks?

   • ADisable the correlation rule entirely
   • BIncrease the threshold to 10 failed attempts within five minutes
   • CCreate a SOAR playbook that automatically blocks the user account after two failed attempts
   • DRefine the correlation rule to require failed attempts from the same source IP across multiple user accounts
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an incident, the incident response team needs to quickly determine which systems were affected by a malware infection. They have a SIEM that collects logs from all endpoints and network devices. Which SIEM capability is most directly useful for this task?

   • AAutomatically block the malware's command-and-control server on the firewall
   • BGenerate a compliance report for the affected systems
   • CSend an alert to the security team that a malware signature was updated
   • DSearch and query historical logs to identify all systems that communicated with the malware's command-and-control server
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization's SIEM is configured to alert on a single failed login, but the security team wants to detect a brute-force attack that involves multiple failed logins from the same source IP across different user accounts. What is the most effective way to configure the SIEM?

   • ACreate a correlation rule that counts failed logins from the same source IP within a time window and alerts when the count exceeds a threshold
   • BCreate a separate alert for each failed login and rely on analysts to notice the pattern
   • CUse the SIEM's built-in dashboard to display all failed logins in real time
   • DIncrease the logging level on all authentication servers to capture more details
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC wants to automate response to a high-volume, low-severity alert type. The SOAR playbook will automatically quarantine the affected endpoint and block the associated IP. However, the security manager is concerned about false positives disrupting business operations. Which playbook design best balances automation and risk?

   • ADisable automation for this alert type and handle all alerts manually
   • BAutomate both actions for all alerts, and rely on the low severity to indicate low risk
   • CUse a human-in-the-loop step that requires analyst approval before the quarantine action, while automating the IP block
   • DRun the playbook automatically for all alerts, but include a rollback step that restores the endpoint if no analyst confirms within 15 minutes
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an incident, the security team needs to determine which systems were accessed by a compromised account. The SIEM has logs from authentication, network, and endpoint sources. What is the most efficient way to gather this information?

   • AManually review each log source separately to identify access events
   • BAsk the account owner to list the systems they accessed
   • CRun a SIEM search that correlates authentication events with network and endpoint logs for the compromised account
   • DBlock the account immediately and assume the scope is limited to the most recent login
   Reveal Solution Discussion Select an answer first