Event Correlation Concepts and Techniques DFE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a forensic investigation, what is the primary role of a SIEM tool?

   • ATo provide a centralized platform for correlating events from multiple sources to reconstruct attack timelines
   • BTo encrypt network traffic to prevent interception
   • CTo scan web applications for SQL injection vulnerabilities
   • DTo create bit-for-bit copies of hard drives for evidence preservation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a forensic investigation, an analyst needs to correlate events from a web server, a database server, and a firewall. The logs are in different formats: the web server uses Common Log Format, the database uses its own timestamp format, and the firewall uses UTC. What is the first step the analyst should take to enable effective correlation?

   • ACollect all logs into a single spreadsheet for manual comparison.
   • BConvert all timestamps to the local time zone of the analyst.
   • CNormalize all logs into a common format with a unified timestamp standard.
   • DIdentify the source IP addresses in each log to match events.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A SIEM generates an alert for a possible brute-force attack, but further analysis shows it was a user mistyping their password multiple times. This scenario best illustrates which challenge in event correlation?

   • AData volume
   • BTime synchronization
   • CNormalization errors
   • DFalse positives
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to detect a distributed denial-of-service (DDoS) attack that involves many source IPs sending traffic to a single web server. They have a SIEM with correlation capabilities. Which correlation approach would be most effective for detecting this type of attack?

   • AManually review all firewall logs to identify unusual traffic patterns.
   • BUse a machine learning model to classify each individual request as malicious or benign.
   • CCreate a rule that alerts when any single source IP sends more than 100 requests per minute.
   • DAggregate traffic by destination IP and trigger an alert when the total traffic volume exceeds a threshold.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is choosing between two SIEM solutions: one with advanced machine learning capabilities and a higher cost, and one with only rule-based correlation at a lower cost. The company has a mature security team that is skilled at writing and tuning rules, and they face a high volume of alerts. Which solution is more appropriate for their needs?

   • ABoth, because they need both rule-based and ML capabilities to handle the volume.
   • BThe rule-based SIEM, because the skilled team can effectively tune rules to reduce false positives without needing ML.
   • CNeither, because SIEM solutions are not effective for web attack forensics.
   • DThe ML-based SIEM, because it will automatically reduce false positives without manual effort.
   Reveal Solution Discussion Select an answer first