Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   When a SIEM generates an alert based on a set of predefined rules, what is this process called?

   • AAlerting
   • BCollection
   • CNormalization
   • DStorage
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A SIEM is ingesting logs from a custom application that outputs timestamps in a non-standard format (e.g., '2024-03-01 14:30:22.123456'). The correlation engine is not matching events from this application with events from other sources because the timestamps are not being converted to the SIEM's standard time format. What should the administrator do to fix this?

   • AConfigure a custom parser for the application's log format to extract and convert the timestamp
   • BStore the logs without normalization and query them manually
   • CDisable timestamp parsing for that source
   • DChange the application's time zone to match the SIEM server
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is a core function of a SIEM system?

   • AUser authentication, authorization, and accounting (AAA)
   • BPacket filtering, stateful inspection, and network address translation
   • CLog collection, normalization, correlation, alerting, and reporting
   • DMalware signature updates, sandboxing, and endpoint isolation
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A small company has separate logs from its firewall, antivirus, and web server. The security manager wants a single view that can show a potential attack that spans all three systems. What is the primary reason to deploy a SIEM in this situation?

   • ATo store the logs in a separate location for backup purposes only
   • BTo aggregate and correlate events across the three sources to detect multi-stage attacks
   • CTo replace the firewall, antivirus, and web server logs with a single log format
   • DTo automatically block malicious IPs at the firewall
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following best describes the role of SIEM in a security operations center (SOC)?

   • AIt encrypts data at rest and in transit to protect sensitive information
   • BIt provides a centralized platform for collecting and analyzing security event data to help detect incidents and meet compliance requirements
   • CIt performs vulnerability scans and automatically applies patches to affected systems
   • DIt acts as a network firewall that filters inbound and outbound traffic based on security rules
   Reveal Solution Discussion Select an answer first