Endpoint and Network Data in SIEM SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A SIEM correlates a network alert about a suspicious outbound connection with an endpoint alert showing a newly created process on the same host. What does this correlation enable the SOC to do?

   • AAutomatically patch the affected endpoint
   • BIdentify the full attack chain from the initial compromise to the network communication
   • CConfirm that the network alert is a false positive
   • DDetermine the exact vulnerability exploited in the application
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst needs to detect when a user attempts to run an unauthorized application on their workstation. Which endpoint data source would provide the most direct evidence?

   • AFile integrity monitoring logs showing changes to the application directory.
   • BNetwork connection logs showing the application's network activity.
   • CAuthentication logs showing the user's login events.
   • DProcess creation logs (e.g., Windows Event 4688 or Sysmon Event 1) showing the executable name and path.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC needs to ingest full packet captures from a 10 Gbps network link into its SIEM for forensic analysis, but the storage budget only supports retaining 30 days of indexed logs. The team also needs real-time alerting on suspicious traffic patterns. Which approach best balances forensic completeness with cost and real-time detection?

   • ASend NetFlow records to the SIEM for real-time alerting and store raw packet captures in a separate low-cost storage tier for on-demand retrieval
   • BIngest only firewall logs and disable packet capture entirely
   • CUse a packet capture appliance that only stores packet headers and discard payloads
   • DIngest full packet captures into the SIEM and index all fields for fast search
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst notices that Windows event logs from domain controllers arrive in the SIEM with the raw Event ID and message text, but process creation events from the same hosts are missing the parent process ID. The analyst needs to correlate a suspected lateral movement chain that depends on parent-child process relationships. Which action best addresses the gap?

   • AConfigure the Windows event collection to forward Security event log 4688 with the 'Include command line in process creation events' policy enabled and verify the SIEM parser extracts ParentProcessId.
   • BAsk the network team to enable NetFlow on the domain controller switches so the SIEM can infer parent-child relationships from network flows.
   • CCreate a SIEM correlation rule that uses the raw message text to parse the parent process ID from the existing event logs.
   • DEnable Sysmon on the domain controllers and forward only Sysmon Event ID 1 to the SIEM, then disable native Windows Security event forwarding to reduce noise.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization has endpoint detection and response (EDR) and a SIEM. The EDR detects a suspicious PowerShell script on a host, but the SIEM does not show any corresponding network connection from that host. The analyst must decide whether to escalate. Which consideration is most important?

   • AThe EDR alert is definitely a true positive because EDR is more reliable than SIEM
   • BThe SIEM may not be receiving all network logs, or the script may have used a protocol not logged
   • CThe EDR alert may be a false positive if no network connection is observed
   • DThe SIEM should be reconfigured to block the script before further analysis
   Reveal Solution Discussion Select an answer first