Endpoint and Network Data in SIEM SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating a malware infection that communicates over HTTP. Which network data source would provide the most useful information about the malware's command-and-control activity?

   • AHTTP proxy logs with URLs and user agents
   • BNetFlow records showing only IP and port pairs
   • CWindows Event Log for application errors
   • DDHCP lease logs
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC wants to detect when a user installs unauthorized software on their workstation. Which endpoint data source would provide the most direct evidence?

   • AWindows Event Log for MSI installer events
   • BNetFlow records showing traffic to a software download site
   • CFirewall logs showing outbound connections
   • DDNS logs for the vendor's update domain
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has a SIEM that ingests endpoint logs (Windows Event Logs, Sysmon) and network logs (firewall, proxy). A user's workstation shows a PowerShell process that made an outbound connection to a known malicious IP. The firewall log confirms the connection, but the proxy log shows no request for that IP. The analyst needs to determine if the connection was blocked or allowed. Which data source should the analyst prioritize?

   • AProxy log, because it shows HTTP/HTTPS requests and can indicate if the traffic was filtered.
   • BSysmon Event ID 3 (network connection), because it shows the process-level connection attempt.
   • CDNS log, because it shows if the host resolved the malicious domain.
   • DFirewall log, because it shows the actual allow/deny decision for the outbound connection.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC is investigating a data breach. The SIEM shows a large outbound transfer from a database server to an external IP, but the endpoint logs for that server are incomplete because the server was recently rebuilt. Which network data source would be most valuable for determining what data was exfiltrated?

   • ANetFlow records showing the volume and duration
   • BDNS logs for the external domain
   • CFull packet captures of the outbound session
   • DFirewall logs showing the allowed connection
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC team is investigating a potential insider threat. The SIEM shows that an employee's workstation accessed a sensitive database and then made a large outbound transfer to a personal cloud storage service. Which combination of data sources provides the most complete evidence for the investigation?

   • ADatabase access logs showing the employee's queries, endpoint logs showing the process used, and network logs showing the outbound transfer.
   • BOnly the endpoint logs showing the process used.
   • COnly the network logs showing the outbound transfer.
   • DOnly the database access logs showing the employee's queries.
   Reveal Solution Discussion Select an answer first