Endpoint and Network Data in SIEM SCE Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   Why does combining endpoint and network data in a SIEM provide a more comprehensive security view than using either alone?

   • AIt enables the SIEM to detect threats that span both host and network activity
   • BIt eliminates the need for any other security tools
   • CIt allows the SIEM to store more data for longer periods
   • DIt ensures that all data is encrypted in transit
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following best describes how a SIEM typically collects endpoint and network data?

   • ABy installing agents on endpoints and using collectors or syslog for network devices
   • BBy using a separate SIEM for each data source and then merging the results
   • CBy manually uploading log files from each device on a daily basis
   • DBy directly querying the SIEM database for all historical data
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A SOC team is investigating a potential data breach. The SIEM shows that a user's workstation made an outbound connection to a cloud storage service, and the same user's account was used to access a sensitive file share. Which combination of data sources provides the strongest evidence of data exfiltration?

   • AOnly the endpoint file access logs showing the user accessed the sensitive files.
   • BAuthentication logs showing the user logged in successfully.
   • COnly the network logs showing the outbound connection.
   • DEndpoint file access logs showing the user accessed sensitive files, and network logs showing the outbound connection to the cloud storage service.
   Reveal Solution Discussion Select an answer first