Events, Incidents, and Logs SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has a SIEM that ingests logs from firewalls, endpoints, and authentication servers. They are seeing an increase in false positives from a rule that triggers on 'multiple failed logins followed by a success.' The rule does not account for users who legitimately mistype passwords. The SOC wants to reduce false positives without missing real attacks. Which approach is most effective?

   • AAdd a suppression rule that ignores all failed logins from known users.
   • BIncrease the threshold for failed logins to 100 before triggering an alert.
   • CModify the rule to require a successful login from a different IP or geolocation within a short time window.
   • DDisable the rule and rely on manual log review.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator is configuring a router to send logs to a central SIEM. The router supports syslog. Which configuration step is essential to ensure the SIEM receives and correctly interprets the logs?

   • ASet the syslog server IP address and ensure the SIEM is configured to listen on the appropriate UDP/TCP port.
   • BSet the router's hostname to match the SIEM's name.
   • CConfigure the router to send logs in JSON format.
   • DDisable the firewall on the router to allow log transmission.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC analyst is reviewing a report that lists 'multiple failed logins' as an incident. The analyst argues that this should be classified as an event. Which reasoning supports the analyst's argument?

   • AAn incident can only be declared by management.
   • BFailed logins are not recorded in logs.
   • CMultiple failed logins are always an incident because they indicate an attack.
   • DMultiple failed logins alone do not necessarily indicate a security impact; they are a series of events.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to improve its ability to detect insider threats. Which log sources should be prioritized for monitoring user activity?

   • AAuthentication logs, file access logs, and email logs.
   • BOnly firewall logs.
   • COnly DNS logs.
   • DOnly router logs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do logs primarily support incident detection?

   • ABy providing a historical record that can be analyzed for patterns and anomalies.
   • BBy automatically blocking malicious traffic before it reaches the network.
   • CBy encrypting sensitive data to prevent unauthorized access.
   • DBy replacing the need for security monitoring tools.
   Reveal Solution Discussion Select an answer first