Event Correlation Concepts and Techniques DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small company has a SIEM but limited staffing. They want to detect known attack patterns with minimal false positives and without requiring constant tuning. Which correlation technique is most appropriate for this environment?

   • ARule-based correlation using well-defined signatures for known attacks.
   • BStatistical correlation that alerts on any deviation from baseline traffic.
   • CManual correlation performed by the existing staff on a daily basis.
   • DMachine learning correlation that requires ongoing model training and tuning.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A small company wants to improve its ability to detect web attacks by correlating logs from its web server, firewall, and authentication system. The company has a limited budget and no dedicated security staff. Which tool would best meet their needs for automated event correlation?

   • AA packet capture tool that records all network traffic for later analysis.
   • BA cloud-based SIEM service that ingests logs and provides built-in correlation rules.
   • CA vulnerability scanner that identifies missing patches on the web server.
   • DA spreadsheet application with manual filtering and pivot tables.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic examiner is investigating a web attack and has collected logs from the web server, database server, and a network intrusion detection system (IDS). The examiner wants to determine the exact sequence of events that led to data exfiltration. What is the primary purpose of correlating these events?

   • ATo encrypt the logs to prevent tampering.
   • BTo delete irrelevant events from the logs.
   • CTo reduce the storage space required for the logs.
   • DTo reconstruct the attack timeline and identify the root cause and impact.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is correlating events from a web server and an authentication server to investigate a possible account takeover. The authentication server logs show a successful login from a new device, and the web server logs show a subsequent change to the user's email address. The analyst wants to confirm that these events are related. Which additional data would be most useful for correlation?

   • AThe source IP address of the login and the source IP address of the email change request.
   • BThe user's password reset history.
   • CThe user's browser history on the new device.
   • DThe authentication server's CPU usage at the time of login.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is investigating a web attack that involved multiple stages: a port scan, a vulnerability exploit, and data exfiltration. The analyst has logs from the firewall, web server, and DNS server. The logs are in different formats and timezones. What is the most important first step in correlating these events?

   • ANormalize the logs into a common format and timezone to enable accurate correlation.
   • BIdentify the source IP addresses in each log to see if they match.
   • CDetermine which log source is most trustworthy and rely on it.
   • DCreate a timeline of events based on the timestamps as they appear in the logs.
   Reveal Solution Discussion Select an answer first