Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security team is planning SIEM storage. They must retain security logs for 12 months to meet a compliance requirement. The SIEM receives about 500 GB of logs per day. They want to keep storage costs reasonable while ensuring that older logs remain searchable for investigations. What should they do?

   • ACompress logs and store them only in cold storage with no indexing
   • BStore all logs on high-performance SSD storage for the full 12 months
   • CReduce retention to 6 months to save costs
   • DUse tiered storage with fast storage for recent logs and cheaper archival storage for older logs
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which component of a SIEM architecture is responsible for receiving raw logs from various sources?

   • ACorrelation engine
   • BStorage
   • CCollector
   • DDashboard
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst is investigating a potential malware infection on a laptop. The SIEM shows an alert for a suspicious outbound connection from the laptop to an external IP. To confirm the infection, the analyst wants to see if the laptop also downloaded a file from that IP. Which additional data source should the analyst check in the SIEM?

   • AAuthentication logs that show user logins
   • BProxy logs that record HTTP/HTTPS requests and file downloads
   • CDNS logs that show the hostname resolution
   • DVulnerability scan reports
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key factor that determines SIEM storage retention requirements?

   • AThe color scheme of the dashboard
   • BThe number of SIEM vendors used
   • CCompliance regulations and organizational policies
   • DThe size of the security team
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A financial institution is deploying a SIEM. They have a strict data residency requirement: all customer transaction logs must remain within the country. They also need to correlate transaction data with threat intelligence feeds from a global provider. The threat intelligence is not subject to residency rules. Which deployment model is most appropriate?

   • AHybrid: cloud SIEM for transaction logs, on-premises for threat intelligence
   • BCloud-based SIEM in a region outside the country
   • CHybrid: on-premises SIEM for transaction logs, cloud SIEM for threat intelligence correlation
   • DOn-premises SIEM with manual threat intelligence updates
   Reveal Solution Discussion Select an answer first