A SOC manager is planning SIEM storage for a 5-year retention period. The compliance team requires that logs be immutable to prevent tampering. The SIEM vendor offers both on-premises and cloud storage options. Which storage approach best meets the immutability requirement while controlling costs?

Use cloud object storage with WORM (Write Once Read Many) policy

Use tape backups stored offsite

Use on-premises RAID storage with periodic backups

Store logs in a database with restricted permissions

A company is migrating from an on-premises SIEM to a cloud-based SIEM. The security team is concerned about the cost of storing high-volume, low-value logs (e.g., firewall traffic logs) for the required 12-month retention. They also need to keep the ability to query those logs for investigations. Which storage strategy should they choose?

Store all logs in the same high-performance storage tier for 12 months

Reduce retention to 6 months to save cost

Exclude firewall logs from the SIEM entirely

Use a lower-cost storage tier for older logs and keep recent logs on high-performance storage

What is the primary purpose of a Security Information and Event Management (SIEM) system?

To replace firewalls and intrusion prevention systems as the first line of network defense

To automatically patch vulnerabilities in operating systems and applications

To aggregate, correlate, and analyze security event data from multiple sources to support threat detection and compliance

To encrypt all network traffic to ensure confidentiality of data in transit

EC-CouncilSOC Essentials

Domain 4Objective 3

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 6)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

Questions 26–30

26expert · hard
A SOC manager is planning SIEM storage for a 5-year retention period. The compliance team requires that logs be immutable to prevent tampering. The SIEM vendor offers both on-premises and cloud storage options. Which storage approach best meets the immutability requirement while controlling costs?
Select an answer first
27expert · hard
A company is migrating from an on-premises SIEM to a cloud-based SIEM. The security team is concerned about the cost of storing high-volume, low-value logs (e.g., firewall traffic logs) for the required 12-month retention. They also need to keep the ability to query those logs for investigations. Which storage strategy should they choose?
Select an answer first
28foundation · easy
In a SIEM architecture, which component is used to visually present security events and alerts to analysts?
Select an answer first
29application · medium
A SIEM administrator notices that the correlation engine is slow and alerts are delayed. The administrator suspects that the parsing and normalization of logs is consuming too much CPU. Which component should the administrator consider scaling or offloading to improve performance?
Select an answer first
30foundation · easy
What is the primary purpose of a Security Information and Event Management (SIEM) system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 6)

Questions 26–30

A SOC manager is planning SIEM storage for a 5-year retention period. The compliance team requires that logs be immutable to prevent tampering. The SIEM vendor offers both on-premises and cloud storage options. Which storage approach best meets the immutability requirement while controlling costs?

In a SIEM architecture, which component is used to visually present security events and alerts to analysts?

A SIEM administrator notices that the correlation engine is slow and alerts are delayed. The administrator suspects that the parsing and normalization of logs is consuming too much CPU. Which component should the administrator consider scaling or offloading to improve performance?

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Keep studying — SOC Components and Architecture