What is the primary purpose of log normalization in a SIEM?

To compress logs to reduce storage requirements

To convert logs from various formats into a common, standardized format for analysis

To encrypt logs to protect them in transit

To delete duplicate logs to improve performance

A SIEM is receiving logs from a Cisco ASA firewall, a Linux server, and a Windows domain controller. The SOC analyst notices that the same source IP appears in all three logs but the IP field is named differently in each source. What is the most appropriate way to handle this in the SIEM?

Manually edit the raw logs to rename the IP field to a consistent name before ingestion

Ignore the field name differences and write rules that use wildcards to match any IP field

Use the SIEM's parsing and normalization engine to map each source's IP field to a common field, such as 'src_ip'

Create separate correlation rules for each log source, referencing the source-specific field names

A manufacturing company with a legacy on-premises SIEM wants to expand log collection to its new cloud-based SaaS applications while keeping existing on-premises log sources unchanged. The security team has limited staff and wants to minimize changes to the current SIEM infrastructure. Which deployment model should they adopt?

Replace the on-premises SIEM with a cloud-based SIEM and migrate all log sources to the cloud

Configure the SaaS applications to send logs directly to the on-premises SIEM via syslog

Deploy a hybrid SIEM that forwards cloud application logs to the existing on-premises SIEM

Use a separate cloud-based SIEM for SaaS logs and keep the on-premises SIEM for all other logs

A SOC wants to automatically enrich SIEM alerts with the latest threat intelligence about malicious IP addresses. Which integration should they configure?

Threat intelligence platform (TIP) integration

EC-CouncilSOC Essentials

Domain 4Objective 4

SIEM Deployment Models and Data Sources SCE Practice Questions (Page 4)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 16–20

16foundation · easy
What is the primary purpose of log normalization in a SIEM?
Select an answer first
17application · medium
A SIEM is receiving logs from a Cisco ASA firewall, a Linux server, and a Windows domain controller. The SOC analyst notices that the same source IP appears in all three logs but the IP field is named differently in each source. What is the most appropriate way to handle this in the SIEM?
Select an answer first
18application · medium
A manufacturing company with a legacy on-premises SIEM wants to expand log collection to its new cloud-based SaaS applications while keeping existing on-premises log sources unchanged. The security team has limited staff and wants to minimize changes to the current SIEM infrastructure. Which deployment model should they adopt?
Select an answer first
19application · medium
A SOC wants to automatically enrich SIEM alerts with the latest threat intelligence about malicious IP addresses. Which integration should they configure?
Select an answer first
20foundation · easy
A security team is evaluating SIEM deployment options. They want to avoid capital expenditure for hardware, scale quickly during peak log volumes, and rely on the vendor to handle system maintenance. Which SIEM deployment model best fits these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

SIEM Deployment Models and Data Sources SCE Practice Questions (Page 4)

Questions 16–20

What is the primary purpose of log normalization in a SIEM?

A SIEM is receiving logs from a Cisco ASA firewall, a Linux server, and a Windows domain controller. The SOC analyst notices that the same source IP appears in all three logs but the IP field is named differently in each source. What is the most appropriate way to handle this in the SIEM?

A SOC wants to automatically enrich SIEM alerts with the latest threat intelligence about malicious IP addresses. Which integration should they configure?

A security team is evaluating SIEM deployment options. They want to avoid capital expenditure for hardware, scale quickly during peak log volumes, and rely on the vendor to handle system maintenance. Which SIEM deployment model best fits these requirements?

Keep studying — SOC Components and Architecture