SIEM Deployment Models and Data Sources SCE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company has an on-premises SIEM that is reaching capacity. They are planning to migrate to a cloud-based SIEM. The security team is concerned about the cost of data transfer and the need to retain logs for 5 years. They also have a hybrid network with some on-premises and some cloud workloads. Which approach best balances cost and compliance?

   • AMigrate all logs to the cloud SIEM without filtering
   • BUse a hybrid SIEM with log collectors on-premises that forward only relevant logs to the cloud SIEM
   • CUse a separate cloud SIEM for cloud workloads and keep the on-premises SIEM for on-premises logs
   • DKeep the on-premises SIEM and do not migrate
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A startup with a small SOC team wants to deploy a SIEM but has no dedicated IT staff to maintain servers. They expect log volume to grow unpredictably as they add new services. They also need to retain logs for at least one year for compliance. Which deployment model is most appropriate?

   • ACloud-based SIEM with a pay-as-you-go ingestion model and managed storage tiers
   • BOn-premises SIEM on a single server with a large disk array
   • CHybrid SIEM with on-premises collectors and a cloud-based analytics engine
   • DOpen-source SIEM installed on a spare laptop
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a SIEM that ingests firewall logs and EDR alerts. The SIEM generates an alert when a firewall log shows a connection to a known malicious IP and an EDR alert on the same host. The SOC is experiencing a high false-positive rate because the EDR alert is often a generic 'suspicious behavior' that is not related to the network connection. How should the SOC refine the correlation rule?

   • ARemove the EDR requirement and alert only on firewall logs to the malicious IP
   • BUse a time window of 24 hours between the firewall log and the EDR alert
   • CIncrease the severity threshold of the EDR alert to only include critical alerts
   • DRequire the EDR alert to reference the same destination IP as the firewall log
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SIEM is receiving logs from a network device that uses a proprietary log format. The SIEM's default parser does not recognize the format, and the logs are being stored as raw text without being normalized. The SOC wants to search for a specific event type. What is the most efficient way to make these logs searchable?

   • AAsk the vendor to change the log format to a standard format like CEF
   • BConvert the proprietary format to JSON using a third-party tool before sending to the SIEM
   • CUse the SIEM's raw text search to find the event type
   • DWrite a custom parser in the SIEM to extract fields from the proprietary format and map them to the common schema
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does a SIEM typically integrate with an EDR solution to improve detection?

   • ABy ingesting EDR alerts and endpoint telemetry to correlate with other logs
   • BBy replacing the EDR's endpoint sensors
   • CBy storing all endpoint files for forensic analysis
   • DBy directly blocking malicious traffic on endpoints
   Reveal Solution Discussion Select an answer first