A SOC team wants to detect data exfiltration attempts where an internal host sends large volumes of data to an external IP over HTTPS. The SIEM currently ingests firewall logs and DNS logs. Which additional network data source would most directly support this detection?

SNMP traps from the external firewall interface.

NetFlow records from the perimeter router to identify long-duration, high-byte-count flows to external destinations.

DHCP lease logs from the internal DHCP server.

Full packet capture (PCAP) of all internal traffic stored for 90 days.

A SOC analyst is investigating a potential privilege escalation on a Linux server. Which endpoint data source would provide the most direct evidence of a user attempting to switch to the root account?

Authentication logs (e.g., /var/log/auth.log) showing 'su' or 'sudo' events.

File integrity monitoring logs showing changes to /etc/passwd.

Process execution logs from auditd showing all commands run by the user.

Network connection logs showing SSH sessions to the server.

A SOC detects a workstation beaconing to an external IP every 60 seconds. Endpoint logs show a legitimate scheduled task running a maintenance script that makes an HTTP request to that IP. The IP is not on any threat intelligence list. What is the most appropriate next step?

Close the alert as a false positive because the traffic is from a scheduled task

Ignore the alert because the endpoint is a workstation, not a server

Block the IP immediately because beaconing is always malicious

Investigate the script and the external IP further before deciding

An analyst is investigating a possible brute-force attack on a web server. The SIEM has web server access logs and authentication logs from the server. Which combination of data would provide the strongest evidence of a successful brute-force attack?

Multiple failed authentication attempts followed by a successful login from the same source IP, and web access logs showing requests to administrative pages.

Only the authentication logs showing multiple failed attempts.

Only the web server access logs showing many requests to the login page.

Network flow logs showing high traffic to the web server.

Which of the following is an example of endpoint data that a SIEM can ingest to detect malicious process activity?

Sysmon event logs recording process creation

BGP routing updates from a router

Packet captures from a network tap

EC-CouncilSOC Essentials

Domain 4Objective 5

Endpoint and Network Data in SIEM SCE Practice Questions (Page 4)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

4concepts

Questions 16–20

16application · medium
A SOC team wants to detect data exfiltration attempts where an internal host sends large volumes of data to an external IP over HTTPS. The SIEM currently ingests firewall logs and DNS logs. Which additional network data source would most directly support this detection?
Select an answer first
17application · medium
A SOC analyst is investigating a potential privilege escalation on a Linux server. Which endpoint data source would provide the most direct evidence of a user attempting to switch to the root account?
Select an answer first
18expert · hard
A SOC detects a workstation beaconing to an external IP every 60 seconds. Endpoint logs show a legitimate scheduled task running a maintenance script that makes an HTTP request to that IP. The IP is not on any threat intelligence list. What is the most appropriate next step?
Select an answer first
19application · medium
An analyst is investigating a possible brute-force attack on a web server. The SIEM has web server access logs and authentication logs from the server. Which combination of data would provide the strongest evidence of a successful brute-force attack?
Select an answer first
20foundation · easy
Which of the following is an example of endpoint data that a SIEM can ingest to detect malicious process activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.