Event Correlation Concepts and Techniques DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic investigator is correlating events from a web application firewall (WAF) and an application server to determine if a SQL injection attack succeeded. The WAF logs show blocked requests, but the application server logs show successful queries that match the blocked patterns. What should the investigator do first to resolve this discrepancy?

   • ACompare the exact timestamps and request IDs from both logs to see if the blocked requests correspond to the successful queries.
   • BCheck the application server's error logs for database errors.
   • CDisable the WAF to see if the application server is vulnerable.
   • DAssume the WAF logs are accurate and ignore the application server logs.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a SIEM but is struggling with the volume of logs and the number of false positives. The security team wants to improve the accuracy of correlation without increasing staffing. Which approach is most effective?

   • ATune the SIEM correlation rules based on the organization's specific environment and known false positive patterns.
   • BSwitch to a different SIEM vendor to get better default rules.
   • CIncrease the log retention period to ensure more data is available for analysis.
   • DAdd more data sources to the SIEM to provide more context.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of tool is specifically designed to aggregate logs and perform event correlation across an enterprise?

   • ADisk imaging tool
   • BVulnerability scanner
   • CNetwork packet analyzer
   • DSecurity Information and Event Management (SIEM) system
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise is experiencing a high volume of alerts from its SIEM, many of which are false positives. The security team is small and cannot manually review every alert. They need a solution that reduces false positives while still detecting both known and unknown attacks. Which approach best balances these competing requirements?

   • AImplement a machine learning-based correlation engine that learns normal behavior and flags deviations.
   • BDisable all correlation rules and rely on manual log review.
   • CUse statistical correlation that alerts on any deviation from a fixed baseline.
   • DIncrease the thresholds on all existing rule-based correlation rules to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic analyst is correlating events from a web application firewall (WAF) and an application server. The WAF logs show a blocked SQL injection attempt, but the application server logs show a successful database query that matches the same attack pattern. The analyst suspects a false positive in the WAF logs. What is the most appropriate next step?

   • AReview the raw WAF logs and application logs to verify whether the attack actually reached the application.
   • BAssume the WAF is working correctly and conclude that the attack was blocked.
   • CDelete the WAF logs to avoid confusion in the investigation.
   • DIgnore the WAF logs and rely solely on the application logs for the investigation.
   Reveal Solution Discussion Select an answer first