Event Correlation Concepts and Techniques DFE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large organization is experiencing a high volume of SIEM alerts, many of which are false positives. The security team wants to improve detection accuracy without increasing staffing. They are considering two approaches: (1) fine-tuning existing rule-based correlation rules, and (2) implementing a machine learning-based anomaly detection module. Which approach should they choose to best address the false positive problem while maintaining detection of known attack patterns?

   • AFine-tune rule-based rules and use machine learning as a complementary layer to flag anomalies.
   • BUse only machine learning anomaly detection and rely on it to also detect known attacks.
   • CIncrease the thresholds on all rule-based rules to reduce alerts.
   • DImplement machine learning anomaly detection and disable all rule-based rules.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is correlating events from multiple servers and notices that the same user account shows a successful login on two different servers at the exact same second. The analyst suspects a time synchronization issue. What is the best way to confirm this?

   • AAssume the user logged in to both servers simultaneously using a script.
   • BCompare the IP addresses of the login events to see if they are the same.
   • CCheck the system clocks of both servers against a common time source, such as an NTP server.
   • DIgnore the event because it is impossible to log in to two servers at the same time.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security analyst wants to detect unusual network traffic that deviates from the organization's normal baseline. Which correlation technique is most appropriate?

   • ASignature-based correlation
   • BManual correlation
   • CStatistical correlation
   • DRule-based correlation
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the event correlation process, what is the purpose of the normalization step?

   • ATo convert data from various sources into a common format so it can be analyzed consistently
   • BTo encrypt the collected data to protect it during transmission
   • CTo remove all events that are not related to the suspected attack
   • DTo assign a priority level to each event based on its source
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations center (SOC) receives thousands of alerts daily from multiple sources. The team wants to reduce the number of false positives while still detecting novel attacks that do not match known signatures. Which correlation technique should the SOC implement to best address this requirement?

   • AManual correlation performed by analysts reviewing each alert individually.
   • BStatistical correlation that counts the number of events per hour and alerts when the count exceeds a threshold.
   • CMachine learning-based correlation that learns normal behavior patterns and flags anomalies.
   • DRule-based correlation that triggers alerts only when specific predefined conditions are met.
   Reveal Solution Discussion Select an answer first