Which of the following is an example of a SIEM data source?

Network cable length measurements

Intrusion detection system (IDS) alerts

A company wants to detect ransomware activity by correlating suspicious file-encryption behavior with network connections to known malicious IPs. Which two data sources should be integrated into the SIEM to provide the necessary visibility?

Database audit logs and application logs

Endpoint logs and firewall/proxy logs

Physical access logs and CCTV footage

A multinational company is choosing a SIEM deployment model. They have a data residency requirement that logs from EU customers must stay in the EU. They also have a legacy on-premises application that only sends logs via Syslog and cannot be moved to the cloud. The company wants to minimize the amount of hardware they manage. Which deployment model best meets these constraints?

A cloud-based SIEM in the EU with no on-premises components

A cloud-based SIEM in a single US region with Syslog forwarders at each site

A hybrid SIEM with a cloud instance in the EU for EU logs and an on-premises collector for the legacy application

A fully on-premises SIEM with collectors at each site

A SIEM administrator is designing a distributed architecture to handle high log volume from multiple data centers. They need to ensure that if one collector fails, logs are not lost. Which architecture should they implement?

Store logs locally on each device and forward periodically

Increase the correlation engine's processing power

Deploy redundant collectors with load balancing and failover

Use a single powerful collector for all data centers

EC-CouncilSOC Essentials

Domain 4Objective 3

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 3)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 11–15

11foundation · easy
Which of the following is a common use case for a SIEM?
Select an answer first
12foundation · easy
Which of the following is an example of a SIEM data source?
Select an answer first
13application · medium
A company wants to detect ransomware activity by correlating suspicious file-encryption behavior with network connections to known malicious IPs. Which two data sources should be integrated into the SIEM to provide the necessary visibility?
Select an answer first
14expert · hard
A multinational company is choosing a SIEM deployment model. They have a data residency requirement that logs from EU customers must stay in the EU. They also have a legacy on-premises application that only sends logs via Syslog and cannot be moved to the cloud. The company wants to minimize the amount of hardware they manage. Which deployment model best meets these constraints?
Select an answer first
15expert · hard
A SIEM administrator is designing a distributed architecture to handle high log volume from multiple data centers. They need to ensure that if one collector fails, logs are not lost. Which architecture should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 3)

Questions 11–15

Which of the following is a common use case for a SIEM?

Which of the following is an example of a SIEM data source?

A company wants to detect ransomware activity by correlating suspicious file-encryption behavior with network connections to known malicious IPs. Which two data sources should be integrated into the SIEM to provide the necessary visibility?

A SIEM administrator is designing a distributed architecture to handle high log volume from multiple data centers. They need to ensure that if one collector fails, logs are not lost. Which architecture should they implement?

Keep studying — SOC Components and Architecture