In a SIEM, what is the purpose of the correlation engine?

To store logs in a centralized database

To combine events from different sources to identify potential security incidents

What is the primary function of an Intrusion Detection System (IDS)?

To monitor network traffic and alert on suspicious activity

To encrypt all network communications

To filter traffic based on IP addresses

To actively block malicious traffic in real time

A security analyst is evaluating an IDS that has a high false-positive rate because it flags normal administrative activity as suspicious. The analyst wants to reduce false positives while still detecting novel attacks that do not match known signatures. Which approach best balances these goals?

Tune the anomaly-based detection baseline to exclude known administrative activity.

Disable all anomaly-based rules and rely on behavior-based detection.

Increase the sensitivity of the anomaly-based detection thresholds.

Switch to signature-based detection only.

What is a primary advantage of anomaly-based detection over signature-based detection?

It has a lower false positive rate

It can detect previously unknown attacks

It does not require a baseline of normal activity

It requires less processing power

A network administrator needs to block traffic based on the application protocol, such as allowing HTTP but not peer-to-peer file sharing, even if the traffic uses the same port. Which type of firewall is required for this level of inspection?

Application-level firewall (proxy)

EC-CouncilCertified Security Specialist

Domain 1Objective 5

Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 3)

Part of the Network Defense Fundamentals and Controls domain, which makes up ~21% of our current practice bank.

51questions here

11free pages

14concepts

14 Concepts in This Objective

Firewall Fundamentals
Firewall Types
Firewall Architectures
Firewall Configuration and Rules
Intrusion Detection Systems (IDS)
Intrusion Prevention Systems (IPS)
IDS/IPS Detection Methods
IDS/IPS Deployment Considerations
Virtual Private Networks (VPNs)
VPN Protocols and Technologies
VPN Types and Architectures
Security Information and Event Management (SIEM)
SIEM Components and Functions
SIEM Implementation and Use Cases

Questions 11–15

11foundation · easy
In a SIEM, what is the purpose of the correlation engine?
Select an answer first
12foundation · easy
What is the primary function of an Intrusion Detection System (IDS)?
Select an answer first
13expert · hard
A security analyst is evaluating an IDS that has a high false-positive rate because it flags normal administrative activity as suspicious. The analyst wants to reduce false positives while still detecting novel attacks that do not match known signatures. Which approach best balances these goals?
Select an answer first
14foundation · easy
What is a primary advantage of anomaly-based detection over signature-based detection?
Select an answer first
15application · medium
A network administrator needs to block traffic based on the application protocol, such as allowing HTTP but not peer-to-peer file sharing, even if the traffic uses the same port. Which type of firewall is required for this level of inspection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.