Event Correlation Concepts and Techniques DFE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   During an investigation, an analyst is correlating events from a web server and a firewall. The firewall logs show that a particular IP address was blocked, but the web server logs show a successful request from that same IP address at the same time. The analyst suspects a false positive in the firewall logs. What is the most appropriate next step?

   • AAssume the firewall is working correctly and conclude that the request was blocked.
   • BReview the raw firewall and web server logs to verify the actual sequence of events.
   • CDelete the firewall logs to avoid confusion in the investigation.
   • DIgnore the web server logs because the firewall is more reliable.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC team is evaluating SIEM solutions to improve event correlation for web attack detection. They have a high volume of logs and need to reduce false positives. Which SIEM feature is most important for this requirement?

   • AIntegration with threat intelligence feeds for enrichment.
   • BA user-friendly dashboard for visualizing alerts.
   • CA large storage capacity for retaining logs for long periods.
   • DCustomizable correlation rules that allow tuning thresholds and conditions.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic investigator is correlating events from a web server and a database server to determine if a SQL injection attack led to data exfiltration. The web server logs show the attack at 10:00:00 UTC, but the database server logs show the corresponding query at 09:59:30 UTC. The investigator suspects a time synchronization issue. What is the most appropriate action to take?

   • AAssume the attack occurred at 09:59:30 and adjust the web server logs accordingly.
   • BDocument the time offset and apply it when correlating events, then verify the synchronization status of both servers.
   • CIgnore the database logs because the timestamps are unreliable.
   • DAdjust the database server's clock to match the web server and re-run the correlation.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic investigator is examining a web attack that involved multiple steps: reconnaissance, exploitation, and data exfiltration. The investigator has logs from the web server, firewall, and DNS server. What is the primary purpose of correlating these logs?

   • ATo determine which log format is most reliable for the investigation.
   • BTo reconstruct the complete attack timeline by linking related events across different systems.
   • CTo reduce the total number of logs that need to be reviewed.
   • DTo assign blame to a specific system for the attack.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization wants to detect brute-force attacks on its web application. The attack involves many failed login attempts from different IP addresses over a short period. Which correlation technique would be most effective in identifying this pattern?

   • AMachine learning correlation that requires labeled attack data to train a model.
   • BStatistical correlation that monitors the rate of failed logins and alerts when it exceeds a threshold.
   • CRule-based correlation that triggers only when a single IP address fails more than five times.
   • DManual correlation by reviewing each failed login individually.
   Reveal Solution Discussion Select an answer first