Event Correlation Concepts and Techniques DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic team is setting up a process to correlate events for future investigations. They have multiple log sources, including web server access logs, firewall logs, and application logs. To ensure that events can be correlated effectively, what should they do during the data collection phase?

   • ACollect logs only from the web server because it is the primary source of attack data.
   • BStore logs in their native formats without any transformation.
   • CWait until an incident occurs before starting to collect logs.
   • DEnsure all log sources are synchronized to a common time source, such as NTP.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is considering implementing a SIEM to improve its forensic capabilities. The security team wants to correlate events from network devices, servers, and applications. Which primary function of a SIEM supports this requirement?

   • AProviding a backup of all logs for disaster recovery.
   • BReplacing the need for any other security tools.
   • CAutomatically patching vulnerabilities in the network.
   • DCentralized log collection and correlation across multiple sources.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   During an investigation, an analyst notices that logs from a web server and a firewall show different timestamps for the same attack. This is an example of which event correlation challenge?

   • ALack of normalization
   • BData volume
   • CFalse positives
   • DTime synchronization issues
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a forensic investigation, an analyst is correlating events from a web server and an authentication server. The web server logs show a request that triggered a database query, and the authentication server logs show a login for the same user at the same time. The analyst notices that the timestamps differ by several minutes. What is the most likely cause of this discrepancy?

   • AThe web server logs are fake and should be ignored.
   • BThe user logged in twice, once on each server.
   • CThe servers have unsynchronized clocks, causing timestamps to be inaccurate.
   • DThe authentication server is more reliable than the web server.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is using a SIEM to correlate events from multiple sources. The security team notices that the SIEM is generating a large number of alerts, many of which are false positives. They want to reduce the noise without missing real attacks. Which action is most effective?

   • AIncrease the log retention period to have more data for analysis.
   • BDisable all correlation rules and rely on manual review.
   • CAdd more data sources to the SIEM to provide more context.
   • DRefine the correlation rules to be more specific to the organization's environment and known false positive patterns.
   Reveal Solution Discussion Select an answer first