SIEM and SOAR CSE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SIEM is ingesting logs from a legacy application that uses a non-standard timestamp format (e.g., 'MM/DD/YYYY HH:MM:SS AM/PM') and does not include timezone information. The SIEM's default parser expects UTC in ISO 8601 format. As a result, events are being timestamped with the current UTC time at ingestion, not the actual event time. What is the best way to fix this?

   • AChange the legacy application's log format to ISO 8601 with timezone
   • BIgnore the timestamp and use the SIEM's ingestion time for all events
   • CStore the logs without parsing and manually adjust timestamps during investigations
   • DConfigure a custom parser for the legacy application that extracts the timestamp, applies the correct timezone, and converts to UTC
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SIEM generates thousands of low-priority alerts per day, and the security team is overwhelmed. They want to reduce noise while still detecting multi-step attacks that span different systems. Which approach best achieves this?

   • ACreate correlation rules that combine related events from multiple sources into a single alert
   • BDisable all rules except those that generate critical alerts
   • CIncrease the alert threshold for all rules to reduce the number of alerts
   • DAdd more SIEM storage to retain all logs for later forensic analysis
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company's SIEM is receiving logs from cloud services, on-premises servers, and SaaS applications. The security team notices that the same user activity appears with different timestamps and user ID formats across sources. This makes it difficult to correlate a single user's actions. What is the best way to address this?

   • AStore logs in their original format and manually align timestamps during investigations
   • BUse separate dashboards for each source to avoid confusion
   • CConfigure the SIEM to normalize timestamps to UTC and map user IDs to a common identity field
   • DAsk each source to change its log format to match the SIEM's default
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A small company wants to deploy a SIEM to monitor its cloud infrastructure. They have limited staff and need to see security events from multiple cloud services in one place. What is the primary benefit they should expect from the SIEM?

   • AIt will automatically block malicious traffic at the network perimeter
   • BIt will directly patch vulnerable software across the cloud environment
   • CIt will aggregate and correlate logs from diverse sources into a unified view
   • DIt will replace the need for individual cloud service security logs
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the role of correlation rules in a SIEM?

   • ATo define which users can access the SIEM console
   • BTo encrypt log data at rest in the SIEM database
   • CTo automatically patch vulnerable software on endpoints
   • DTo combine multiple events to identify patterns that indicate a security threat
   Reveal Solution Discussion Select an answer first