SIEM and SOAR CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which capability is a defining feature of a SOAR platform?

   • AOrchestrating actions across multiple security tools via integrations
   • BScanning endpoints for malware signatures
   • CStoring long-term log archives for compliance
   • DPerforming deep packet inspection on network traffic
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do SIEM and SOAR typically work together in a security operations center?

   • AThe SOAR collects logs and the SIEM automates responses
   • BThe SIEM sends alerts to the SOAR, which then orchestrates response actions
   • CThey operate independently and do not share data
   • DThe SOAR replaces the SIEM entirely
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's SIEM receives firewall logs in a proprietary format, Windows Event Logs, and AWS CloudTrail JSON. The security team wants to write a single correlation rule that checks for multiple failed logins followed by a successful login across all these sources. What must the SIEM do first to make this rule feasible?

   • ANormalize the logs into a common schema with standardized field names and values
   • BStore the raw logs in a data lake and query them with a search language
   • CCreate separate correlation rules for each log source and combine the alerts manually
   • DEnable real-time log forwarding from all sources to the SIEM collector
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to automate the incident response workflow for a specific alert type. The workflow should: (1) gather threat intelligence, (2) isolate the affected host, and (3) create a ticket. The team wants to ensure that the host is only isolated if the threat intelligence confirms malicious activity. What is the best way to implement this in a SOAR platform?

   • AHave the SOAR platform manually execute each step after analyst approval
   • BUse a separate playbook for each step and trigger them all at once
   • CCreate a playbook with conditional logic that checks the threat intelligence result before executing the isolation step
   • DRun all steps in parallel without any conditions
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of a Security Information and Event Management (SIEM) system?

   • ATo aggregate and analyze security logs to provide visibility into security events
   • BTo store backups of critical business data
   • CTo block malicious network traffic in real time
   • DTo replace the need for antivirus software on endpoints
   Reveal Solution Discussion Select an answer first