A SOC analyst notices that the SIEM is not correlating events from different sources, making it difficult to detect multi-step attacks. The SIEM receives logs from firewalls, servers, and endpoints. What should the analyst configure to improve detection of related events?

Create correlation rules that link events based on common attributes such as source IP, destination IP, and time window.

Increase the log retention period to store more data.

Disable alerting to reduce noise.

Add more log sources to the SIEM.

A network administrator wants to monitor traffic on a core switch to detect potential intrusions without affecting network performance. The monitoring solution must not introduce a point of failure. Which deployment approach should be used?

Deploy an IPS inline between the switch and the router.

Deploy a firewall with intrusion prevention on the switch.

Deploy a network tap that disconnects if the tap fails.

Deploy an IDS connected to a SPAN port on the switch.

An organization wants to deploy an IPS to protect its internal network from external threats. The IPS must be able to block malicious traffic before it reaches internal servers. Where should the IPS be placed?

On the internal server's host firewall.

On a SPAN port of the core switch.

Inline between the firewall and the internal network.

Outside the firewall facing the internet.

A security team needs to meet a compliance requirement that mandates centralized collection and analysis of logs from all servers and network devices. The solution must also provide automated alerts for suspicious activity. Which technology should be implemented?

Use a network firewall with logging enabled.

Enable syslog forwarding to a central log server without analysis.

Deploy a SIEM platform that aggregates logs, correlates events, and generates alerts.

Install antivirus software on all servers.

In network security, what is the fundamental function of a firewall?

To provide a secure tunnel for remote users

To inspect and control traffic based on security policies

To scan files for viruses and quarantine infected ones

To authenticate users and grant access to applications

EC-CouncilCertified Security Specialist

Domain 1Objective 5

Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 8)

Part of the Network Defense Fundamentals and Controls domain, which makes up ~21% of our current practice bank.

51questions here

11free pages

14concepts

14 Concepts in This Objective

Firewall Fundamentals
Firewall Types
Firewall Architectures
Firewall Configuration and Rules
Intrusion Detection Systems (IDS)
Intrusion Prevention Systems (IPS)
IDS/IPS Detection Methods
IDS/IPS Deployment Considerations
Virtual Private Networks (VPNs)
VPN Protocols and Technologies
VPN Types and Architectures
Security Information and Event Management (SIEM)
SIEM Components and Functions
SIEM Implementation and Use Cases

Questions 36–40

36application · medium
A SOC analyst notices that the SIEM is not correlating events from different sources, making it difficult to detect multi-step attacks. The SIEM receives logs from firewalls, servers, and endpoints. What should the analyst configure to improve detection of related events?
Select an answer first
37application · medium
A network administrator wants to monitor traffic on a core switch to detect potential intrusions without affecting network performance. The monitoring solution must not introduce a point of failure. Which deployment approach should be used?
Select an answer first
38application · medium
An organization wants to deploy an IPS to protect its internal network from external threats. The IPS must be able to block malicious traffic before it reaches internal servers. Where should the IPS be placed?
Select an answer first
39application · medium
A security team needs to meet a compliance requirement that mandates centralized collection and analysis of logs from all servers and network devices. The solution must also provide automated alerts for suspicious activity. Which technology should be implemented?
Select an answer first
40foundation · easy
In network security, what is the fundamental function of a firewall?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.