Endpoint and Network Data in SIEM SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SIEM engineer is ingesting endpoint logs from 5,000 Windows workstations. The logs are sent via a Windows Event Forwarder (WEF) to a collector, which then forwards them to the SIEM. The SIEM is missing many events, and the collector's event queue is consistently full. Which change would most effectively reduce the backlog without losing critical security events?

   • AFilter the WEF subscription to forward only security-relevant event IDs (e.g., 4624, 4625, 4688) instead of all events.
   • BConfigure the SIEM to drop events that fail parsing instead of storing them in a dead-letter queue.
   • CSend logs directly from workstations to the SIEM, bypassing the collector.
   • DIncrease the collector's event queue size and add more CPU/RAM to the collector.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SIEM is receiving firewall logs in a vendor-specific format and endpoint logs in a different format. Analysts want to search for a single IP across both sources. What must be configured in the SIEM to allow this unified search?

   • AA data enrichment feed that adds geo-location to IPs
   • BAn indexer that stores both log types in the same index
   • CField mapping and normalization rules
   • DA new correlation rule that joins the two log types
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SIEM is receiving logs from multiple sources, but the timestamps are in different time zones, causing events to appear out of order. What should be configured to correct this?

   • AA correlation rule that sorts events by source
   • BA data enrichment feed that adds time zone information
   • CTimestamp normalization to UTC during ingestion
   • DA parser that extracts the timestamp field
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In a SIEM, what is the process of converting raw log data from various sources into a common, structured format so that it can be analyzed consistently?

   • ACorrelation
   • BNormalization
   • CAggregation
   • DParsing
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SIEM engineer is integrating a new network sensor that sends logs in a proprietary JSON format. The SIEM's default parser does not recognize the fields. Which step is essential to ensure the logs are searchable and correlate with existing endpoint data?

   • AStore the raw JSON logs in a separate index and only search them manually when needed.
   • BConvert the JSON logs to CSV format before ingestion.
   • CEnable the SIEM's auto-discovery feature and rely on it to infer all field mappings.
   • DCreate a custom parsing rule to map the JSON fields to the SIEM's common information model (CIM) fields.
   Reveal Solution Discussion Select an answer first