A startup with a small security team wants to deploy a SIEM quickly without managing physical infrastructure. They have a variable log volume and want to pay only for what they use. Which deployment model is most appropriate?

Open-source SIEM on a single server

Which SIEM deployment model involves hosting the SIEM infrastructure in the organization's own data center?

Managed security service provider (MSSP)

A company's SIEM is receiving logs from firewalls, endpoints, and Active Directory. The security team wants to generate a weekly report that shows all failed login attempts across all systems. Which SIEM function should be used to produce this report?

Correlation engine to link failed logins with other events

Alerting rules to notify on failed logins

Reporting module that queries normalized logs and schedules the output

Dashboard that displays real-time failed logins

A security team needs to demonstrate to an auditor that their SIEM is effectively detecting and responding to threats. The auditor asks for evidence that the SIEM has generated alerts and that those alerts were acted upon. Which SIEM use case should the team emphasize in their response?

Compliance reporting that includes alert metrics and response tracking

Forensic analysis of past incidents

Real-time correlation for threat detection

EC-CouncilSOC Essentials

Domain 4Objective 3

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 4)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 16–20

16application · medium
A startup with a small security team wants to deploy a SIEM quickly without managing physical infrastructure. They have a variable log volume and want to pay only for what they use. Which deployment model is most appropriate?
Select an answer first
17foundation · easy
Which SIEM deployment model involves hosting the SIEM infrastructure in the organization's own data center?
Select an answer first
18application · medium
A SOC manager wants to use the SIEM to automatically detect a known attack pattern that involves multiple stages: initial access, privilege escalation, and lateral movement. The SIEM should alert when events from different sources match this sequence. Which SIEM capability is most directly required?
Select an answer first
19application · medium
A company's SIEM is receiving logs from firewalls, endpoints, and Active Directory. The security team wants to generate a weekly report that shows all failed login attempts across all systems. Which SIEM function should be used to produce this report?
Select an answer first
20expert · hard
A security team needs to demonstrate to an auditor that their SIEM is effectively detecting and responding to threats. The auditor asks for evidence that the SIEM has generated alerts and that those alerts were acted upon. Which SIEM use case should the team emphasize in their response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.