A financial company must retain SIEM logs for 12 months to meet regulatory requirements. The current SIEM storage is filling up after only 3 months. The company wants to keep all logs for the required period without losing performance. Which approach should the SIEM administrator take?

Increase the alert threshold to reduce log volume

Reduce the log retention period to 3 months

Store logs on slower, cheaper storage tiers for older data while keeping recent logs on fast storage

Disable correlation for all log sources

An organization is integrating a new cloud application into their SIEM. The application provides logs via API, but the SIEM does not have a built-in integration. The logs are in JSON format. What is the most efficient way to get these logs into the SIEM?

Manually copy logs from the application console into the SIEM

Ask the application vendor to send logs in syslog format

Disable logging for the application

Use a collector that can pull from the API and parse JSON

A company has a strict data residency requirement: all security logs must remain within the country's borders. They also want to avoid maintaining physical servers. Which SIEM deployment model should they choose?

Hybrid SIEM with collectors on-premises and storage in a foreign cloud region

Community edition SIEM installed on a local workstation

Cloud-based SIEM in a region located within the required country

What is the purpose of correlation in a SIEM?

To delete duplicate logs to improve performance

To identify patterns and relationships between events from different sources

To encrypt logs to protect them from tampering

To compress logs to save storage space

EC-CouncilSOC Essentials

Domain 4Objective 3

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 5)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 21–25

21application · medium
A financial company must retain SIEM logs for 12 months to meet regulatory requirements. The current SIEM storage is filling up after only 3 months. The company wants to keep all logs for the required period without losing performance. Which approach should the SIEM administrator take?
Select an answer first
22application · medium
An organization is integrating a new cloud application into their SIEM. The application provides logs via API, but the SIEM does not have a built-in integration. The logs are in JSON format. What is the most efficient way to get these logs into the SIEM?
Select an answer first
23application · medium
A company has a strict data residency requirement: all security logs must remain within the country's borders. They also want to avoid maintaining physical servers. Which SIEM deployment model should they choose?
Select an answer first
24foundation · easy
What is the purpose of correlation in a SIEM?
Select an answer first
25application · medium
A SIEM administrator is troubleshooting why events from a network device are not appearing in the SIEM dashboard. The device is configured to send syslog to the SIEM collector, and the collector is receiving the data. However, the events are not showing up in searches. Which component is most likely causing the issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.