A company has a SIEM that receives logs from firewalls, Windows endpoints, and a custom in-house application. The application logs are in a key=value format, while the firewall logs are in syslog format. Analysts are struggling to write queries because field names differ across sources. What should the SIEM administrator do to address this?

Configure parsing rules to map each source's fields into a common schema

Store raw logs separately and query each source individually

Increase the storage capacity to retain more raw logs

Ask the application team to change their logs to syslog format

A SOC team is deploying a SIEM and needs to ingest logs from multiple remote offices. Each office has a different type of firewall and server. The team wants to ensure that logs are received reliably and converted into a standard format before being sent to the central correlation engine. Which SIEM component should be placed at each office?

A forwarder that sends raw logs to the central SIEM for parsing and normalization

A collector with parsing and normalization capabilities that forwards standardized events

A collector that receives raw logs and forwards them to the central SIEM

A parser that normalizes each log type before sending to the central SIEM

A SOC analyst wants to reduce alert fatigue by grouping alerts that originate from the same attack campaign. The SIEM has alerts from multiple rules that share a common indicator, such as the same source IP. What should the analyst configure to group these alerts?

Increase the log retention period

Alert aggregation or deduplication rules

A security team is using their SIEM for both real-time threat detection and monthly compliance reporting. The compliance report requires specific metrics that are not currently captured by any correlation rule. The team wants to generate the report without affecting real-time detection performance. What should they do?

Disable real-time detection while the report runs

Run the report manually whenever needed

Create a separate scheduled search that runs during off-peak hours

Add the metrics to an existing correlation rule

After a security incident, a company needs to determine the exact sequence of events that led to the breach. The SIEM has logs from the firewall, endpoint, and authentication systems. Which SIEM use case should the analyst apply to reconstruct the timeline?

Real-time alerting on new suspicious activity

Compliance reporting for regulatory audits

Forensic analysis by querying historical logs across all sources

Vulnerability scanning of the affected systems

EC-CouncilSOC Essentials

Domain 4Objective 3

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 2)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 6–10

6application · medium
A company has a SIEM that receives logs from firewalls, Windows endpoints, and a custom in-house application. The application logs are in a key=value format, while the firewall logs are in syslog format. Analysts are struggling to write queries because field names differ across sources. What should the SIEM administrator do to address this?
Select an answer first
7application · medium
A SOC team is deploying a SIEM and needs to ingest logs from multiple remote offices. Each office has a different type of firewall and server. The team wants to ensure that logs are received reliably and converted into a standard format before being sent to the central correlation engine. Which SIEM component should be placed at each office?
Select an answer first
8application · medium
A SOC analyst wants to reduce alert fatigue by grouping alerts that originate from the same attack campaign. The SIEM has alerts from multiple rules that share a common indicator, such as the same source IP. What should the analyst configure to group these alerts?
Select an answer first
9expert · hard
A security team is using their SIEM for both real-time threat detection and monthly compliance reporting. The compliance report requires specific metrics that are not currently captured by any correlation rule. The team wants to generate the report without affecting real-time detection performance. What should they do?
Select an answer first
10application · medium
After a security incident, a company needs to determine the exact sequence of events that led to the breach. The SIEM has logs from the firewall, endpoint, and authentication systems. Which SIEM use case should the analyst apply to reconstruct the timeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 2)

Questions 6–10

A SOC analyst wants to reduce alert fatigue by grouping alerts that originate from the same attack campaign. The SIEM has alerts from multiple rules that share a common indicator, such as the same source IP. What should the analyst configure to group these alerts?

After a security incident, a company needs to determine the exact sequence of events that led to the breach. The SIEM has logs from the firewall, endpoint, and authentication systems. Which SIEM use case should the analyst apply to reconstruct the timeline?

Keep studying — SOC Components and Architecture