A SOC analyst is reviewing the data sources available for SIEM analysis. Which of the following is an example of endpoint-generated data that would be relevant to a SIEM?

Firewall deny logs from a perimeter firewall

Windows Security event logs from a workstation

DNS query logs from a corporate DNS server

A SOC team wants to detect port scanning activity from an internal host. Which network data source is most effective for this detection?

NetFlow records showing a single long-duration flow to one destination port.

Firewall logs showing multiple denied connection attempts to different ports on the same destination IP from a single source.

DHCP logs showing the host's IP address changes.

DNS logs showing queries for many different domains from the same host.

A SOC team wants to detect beaconing behavior from malware that communicates with a command-and-control server at regular intervals. Which network data source is most suitable for this detection?

Full packet captures stored for 24 hours.

NetFlow records that capture flow start times and durations for outbound connections.

DNS logs that show only the queried domain names.

Firewall logs that show only allow/deny decisions without timestamps.

A SIEM engineer is integrating a new endpoint detection and response (EDR) solution. The EDR sends alerts in a format that includes the process name, file hash, and the user account. The SIEM already ingests Active Directory logs. Which normalization step is necessary to correlate EDR alerts with user account information?

Disable the EDR's user field because AD logs already have the user information.

Map the EDR's user field to the SIEM's standard 'user' field and ensure it matches the format used in Active Directory logs.

Store the EDR alerts in a separate index and manually cross-reference with AD logs.

Convert the EDR alerts to Syslog format before ingestion.

EC-CouncilSOC Essentials

Domain 4Objective 5

Endpoint and Network Data in SIEM SCE Practice Questions (Page 1)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 1–5

1foundation · easy
A SOC analyst is reviewing the data sources available for SIEM analysis. Which of the following is an example of endpoint-generated data that would be relevant to a SIEM?
Select an answer first
2application · medium
A SOC team wants to detect port scanning activity from an internal host. Which network data source is most effective for this detection?
Select an answer first
3application · medium
A SOC team wants to detect beaconing behavior from malware that communicates with a command-and-control server at regular intervals. Which network data source is most suitable for this detection?
Select an answer first
4application · medium
A SIEM engineer is integrating a new endpoint detection and response (EDR) solution. The EDR sends alerts in a format that includes the process name, file hash, and the user account. The SIEM already ingests Active Directory logs. Which normalization step is necessary to correlate EDR alerts with user account information?
Select an answer first
5foundation · easy
Which network data source would provide the most detailed information about the actual content of a network conversation, such as the payload of a malicious exploit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Endpoint and Network Data in SIEM SCE Practice Questions (Page 1)

Questions 1–5

A SOC analyst is reviewing the data sources available for SIEM analysis. Which of the following is an example of endpoint-generated data that would be relevant to a SIEM?

A SOC team wants to detect port scanning activity from an internal host. Which network data source is most effective for this detection?

A SOC team wants to detect beaconing behavior from malware that communicates with a command-and-control server at regular intervals. Which network data source is most suitable for this detection?

Which network data source would provide the most detailed information about the actual content of a network conversation, such as the payload of a malicious exploit?

Keep studying — SOC Components and Architecture