A SOC is investigating a ransomware outbreak. The SIEM shows that the ransomware binary was downloaded from an external URL and then executed on multiple hosts. The firewall logs show the download, and the EDR logs show the execution. Which data source would provide the most useful additional context to identify the initial infection vector?

Patch management logs showing the hosts are up to date

DNS logs showing the resolution of the external URL

Web proxy logs showing the HTTP request for the download

Email gateway logs showing the phishing email that contained the URL

Which of the following best describes how a SIEM collects logs from various sources?

It requires manual upload of log files by administrators

It only collects logs from cloud-based sources

It uses agents or collectors to forward logs to a central SIEM server

It directly queries each source's database in real time

A SIEM receives logs from a firewall, a web server, and a database server. The logs use different formats and field names. What is the first step the SIEM performs to enable correlation across these sources?

Create correlation rules based on the original log formats

Store the raw logs in a data lake for long-term retention

Forward the logs to a threat intelligence platform for enrichment

Normalize the logs into a common schema

Which of the following is a security tool that commonly feeds data into a SIEM?

Database management system (DBMS)

Intrusion detection system (IDS)

EC-CouncilSOC Essentials

Domain 4Objective 4

SIEM Deployment Models and Data Sources SCE Practice Questions (Page 3)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 11–15

11expert · hard
A SOC is investigating a ransomware outbreak. The SIEM shows that the ransomware binary was downloaded from an external URL and then executed on multiple hosts. The firewall logs show the download, and the EDR logs show the execution. Which data source would provide the most useful additional context to identify the initial infection vector?
Select an answer first
12application · medium
A SOC wants to detect brute-force attacks against their web application. Which data source would provide the most direct evidence of repeated login failures?
Select an answer first
13foundation · easy
Which of the following best describes how a SIEM collects logs from various sources?
Select an answer first
14application · medium
A SIEM receives logs from a firewall, a web server, and a database server. The logs use different formats and field names. What is the first step the SIEM performs to enable correlation across these sources?
Select an answer first
15foundation · easy
Which of the following is a security tool that commonly feeds data into a SIEM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SIEM Deployment Models and Data Sources SCE Practice Questions (Page 3)

Questions 11–15

A SOC wants to detect brute-force attacks against their web application. Which data source would provide the most direct evidence of repeated login failures?

Which of the following best describes how a SIEM collects logs from various sources?

A SIEM receives logs from a firewall, a web server, and a database server. The logs use different formats and field names. What is the first step the SIEM performs to enable correlation across these sources?

Which of the following is a security tool that commonly feeds data into a SIEM?

Keep studying — SOC Components and Architecture