Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which scenario best illustrates the need for a correlation rule rather than a simple alert on a single event?

   • AMultiple failed logins from different IPs followed by a successful login from one of those IPs
   • BA malware signature is detected on a single endpoint
   • CA user receives a phishing email and clicks the link
   • DA single failed login attempt from a known malicious IP address
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC manager wants a dashboard for the weekly team meeting that shows the number of incidents by type, the average time to resolve incidents, and the trend of incidents over the past 4 weeks. Which widgets should be used?

   • ALine chart for incident types, pie chart for resolution time, and bar chart for the trend.
   • BHeatmap for incident types, scatter plot for resolution time, and number widget for the trend.
   • CBar chart for incident types, gauge for average resolution time, and table for the trend.
   • DPie chart for incident types, number widget for average resolution time, and line chart for the trend.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary benefit of customizing a security dashboard for a specific user role?

   • AIt prevents unauthorized users from accessing the SIEM
   • BIt automatically resolves security incidents
   • CIt ensures the user sees the most relevant information for their responsibilities
   • DIt reduces the amount of storage required for logs
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst is designing a dashboard to monitor the health of the SIEM pipeline. They want to display the number of events ingested per minute, the number of alerts generated per hour, and the percentage of events that failed to parse. Which widgets should the analyst use?

   • AThree pie charts, one for each metric.
   • BA line chart for events per minute, a bar chart for alerts per hour, and a gauge for the parse failure percentage.
   • CA scatter plot for events per minute, a histogram for alerts per hour, and a text box for the parse failure percentage.
   • DA single table with all three metrics listed as columns.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A weekly report shows a 40% increase in the number of alerts related to failed logins compared to the previous week. The report also shows that the top 5 source IPs are all internal. What is the most likely actionable insight?

   • AIgnore the increase because it is only a 40% change.
   • BAssume the increase is due to a brute-force attack from external actors.
   • CInvestigate whether an internal application or service is causing the increase in failed logins.
   • DBlock all internal IPs from the firewall to prevent further attacks.
   Reveal Solution Discussion Select an answer first