Introduction to SIEM and SIEM Architecture SCE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC analyst is investigating a potential data exfiltration. The SIEM shows a large outbound transfer from a server to an external IP. The analyst wants to determine if the transfer was a result of a compromised application or a legitimate backup. Which combination of data sources would provide the most useful evidence?

   • AFirewall logs and application logs
   • BDNS logs and DHCP logs
   • CEndpoint logs and antivirus alerts
   • DAuthentication logs and vulnerability scan reports
   Reveal Solution Discussion Select an answer first
2. 42application · hard

   A multinational company is deploying a SIEM. They need to collect logs from offices in multiple countries, but some countries have strict data residency laws requiring logs to stay within their borders. They also want a single dashboard for global visibility. Which deployment model best meets these requirements?

   • AOn-premises collectors in each country with no central dashboard
   • BHybrid, with local collectors in each country and a central cloud SIEM for correlation and dashboards
   • CCloud-based SIEM in a single region
   • DFully on-premises in the company's headquarters
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which SIEM use case involves examining historical log data to understand how a security breach occurred?

   • ALog collection
   • BCompliance reporting
   • CForensic analysis
   • DThreat detection
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In a SIEM, what is the function of normalization?

   • ATo encrypt logs to protect them from unauthorized access
   • BTo delete duplicate logs to improve system performance
   • CTo compress logs to reduce storage requirements
   • DTo convert raw logs from different sources into a common, standardized format
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SIEM administrator is designing an architecture for a large enterprise. The correlation engine is expected to process 50,000 events per second. The team wants to ensure that no events are lost during peak traffic and that the system remains responsive. Which architectural approach is most appropriate?

   • AA setup where the correlation engine is optional and only used for compliance reports
   • BA simple forwarder that sends all logs directly to the storage system
   • CA distributed architecture with load-balanced collectors and a clustered correlation engine
   • DA single monolithic SIEM server with all components on one machine
   Reveal Solution Discussion Select an answer first