Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the main purpose of a security dashboard in a SOC?

   • ATo replace the need for manual log analysis
   • BTo provide a visual summary of security events and metrics for quick analysis
   • CTo automatically respond to incidents
   • DTo store security logs for compliance
   Reveal Solution Discussion Select an answer first
2. 42application · easy

   After a security incident, the SOC lead must produce a report for executive management that summarizes the incident timeline, the attack vector, the impact, and the remediation steps. Which report type is most appropriate?

   • ACompliance report
   • BRaw log export
   • CIncident summary report
   • DMonthly trend report
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of a correlation rule in a SIEM platform?

   • ATo automatically block malicious IP addresses at the firewall
   • BTo collect raw logs from multiple sources and store them for long-term retention
   • CTo detect attack patterns that span multiple events or sources by applying logical conditions
   • DTo generate compliance reports for regulatory audits
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC lead needs to provide a weekly summary of security incidents to the CISO. The summary should include the number of incidents by severity, the average time to respond, and a list of the top 5 incident types. The CISO prefers to receive the report as a PDF attachment in an email every Monday morning. What is the most efficient way to fulfill this requirement?

   • ACreate a report template with the required metrics, schedule it to run every Monday at 7:00 AM, and configure email distribution to the CISO as a PDF attachment.
   • BCreate a dashboard with the required metrics and share the dashboard link with the CISO, asking them to check it every Monday.
   • CSchedule a report to run every day and email it to the CISO, so they always have the latest data.
   • DManually generate the report every Monday by running the queries and exporting the results to a PDF, then email it to the CISO.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following best describes the process of creating a basic correlation rule in a SIEM?

   • ACreate a dashboard widget that displays all security events
   • BDefine the event conditions, set a time window, and specify a threshold for triggering an alert
   • CConfigure a report to be sent daily to the security team
   • DUpload a list of malicious IP addresses and block them at the firewall
   Reveal Solution Discussion Select an answer first