Event Correlation Concepts and Techniques DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company uses a SIEM platform to collect logs from firewalls, web servers, and authentication systems. The security team wants to detect a multi-stage attack where an attacker first scans the network, then exploits a web vulnerability, and finally uses stolen credentials. Which SIEM feature is most directly used to correlate these events?

   • ALog retention policies that determine how long logs are stored.
   • BUser access controls that restrict who can view the SIEM.
   • CDashboard visualization that displays all logs in a single view.
   • DCorrelation rules that define sequences of events across multiple log sources.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic investigator is correlating events from a compromised web server and a database server. The web server logs are in UTC, while the database logs are in local time (UTC+5). The investigator notices that a SQL injection attempt in the web logs appears to occur after the database query in the database logs. What is the most likely issue, and what should the investigator do?

   • AThe database was compromised before the web server; the investigator should focus on the database logs.
   • BThe time difference is due to timezone mismatch; convert all logs to a common timezone before correlating.
   • CThe web server logs are incorrect; the investigator should trust the database logs.
   • DThe SQL injection attempt is unrelated to the database query; the investigator should ignore the web logs.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SIEM analyst is reviewing alerts generated by a correlation rule that flags any login followed by a file download within five minutes. The analyst notices that many alerts are triggered by normal user behavior. What is the most effective way to reduce these false positives?

   • ARemove the file download condition and alert on all logins.
   • BIncrease the time window from five minutes to thirty minutes.
   • CAdd a condition that the login must come from an external IP address.
   • DDisable the rule and rely on manual log review.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   During an investigation, an analyst is correlating events from a web server and an authentication server. The web server logs show a successful login followed by a privilege escalation, but the authentication server logs show no corresponding login event. The analyst suspects that the authentication server logs are incomplete. What is the best course of action?

   • AUse the web server logs as the sole source of truth for the investigation.
   • BConclude that the login did not happen and ignore the web server logs.
   • CAssume the authentication server was compromised and stop the investigation.
   • DCheck the authentication server's log retention policy and collect any archived logs that may contain the missing event.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC is evaluating a SIEM that uses statistical correlation to detect anomalies. The SIEM flags a user who typically logs in from the US suddenly logging in from a foreign country. However, the user is on a legitimate business trip. The SOC wants to reduce such false positives without missing real account takeovers. Which approach is most effective?

   • ADisable the statistical anomaly detection for all users.
   • BIncrease the threshold for what constitutes an anomaly.
   • CIncorporate contextual data, such as travel schedules or VPN usage, into the correlation logic.
   • DRequire manual approval for all alerts before they are investigated.
   Reveal Solution Discussion Select an answer first