Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company recently deployed a SIEM. The security team notices that firewall logs show source IPs in a format like '192.168.1.10', while endpoint logs show the same IP as '192.168.001.010'. A correlation rule that looks for a single source IP across both sources is not triggering. What should the SIEM administrator configure to resolve this?

   • ACreate separate correlation rules for each log source format
   • BEnable log parsing to extract the IP field from both log types
   • CIncrease the log retention period for both sources
   • DConfigure normalization rules to convert IP addresses to a standard format
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Why does a SIEM normalize log data from different sources?

   • ATo encrypt logs to protect them during transmission
   • BTo delete irrelevant logs to save storage space
   • CTo make the data consistent and comparable for analysis
   • DTo reduce the size of logs for faster transmission
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is integrating a legacy mainframe system into their SIEM. The mainframe sends logs in a proprietary binary format that the SIEM's built-in parsers do not support. The logs are critical for compliance. What is the most effective approach?

   • AIgnore the mainframe logs and rely on other sources
   • BManually convert logs and upload them daily
   • CDevelop a custom parser or use a log forwarder that converts the format
   • DAsk the mainframe vendor to change the log format to syslog
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A global company is choosing between a cloud-based SIEM and an on-premises SIEM. They have a predictable log volume and a dedicated IT team, but they are concerned about data sovereignty and want to minimize ongoing operational costs. Which factor should most influence their decision?

   • AThe ability to keep data within specific geographic boundaries
   • BThe vendor's marketing reputation
   • CThe color of the user interface
   • DThe number of pre-built dashboards
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst sees an alert for a single failed login on a user account. The analyst knows that one failed login is common and not suspicious. However, the SIEM also shows that the same user had a successful login from a different country 10 minutes later. The analyst wants the SIEM to only alert when both events occur within a short time window. What should the analyst configure?

   • AA dashboard widget showing login locations
   • BA parsing rule to extract the country from the login logs
   • CA correlation rule that links the failed login and the successful login from different locations within a defined time window
   • DA report that lists all failed logins daily
   Reveal Solution Discussion Select an answer first