A SOC wants to automatically block an IP address at the firewall when the SIEM detects a malicious scan. Which integration is required?

SIEM-to-firewall API integration

SIEM-to-ticketing system integration

SIEM-to-email gateway integration

A SOC analyst is configuring a SIEM to detect unauthorized access attempts across the network. Which combination of data sources would provide the most comprehensive visibility for this use case?

Authentication server logs and firewall logs

Configuration management database (CMDB) data and asset inventory logs

Endpoint detection and response (EDR) alerts and vulnerability scanner reports

Which of the following is a common data source category that a SIEM collects logs from?

Network devices such as routers and switches

Human resources management systems

Physical access control systems

A company is considering moving from an on-premises SIEM to a cloud-based SIEM. They have a highly regulated workload that requires low-latency access to logs for real-time alerting. Their internet connection is reliable but has a 50ms latency to the cloud region. The SOC is concerned about the impact on real-time detection. Which factor is most important to evaluate?

The network latency between the on-premises log sources and the cloud SIEM, and whether it meets the required alerting SLA

The cost of egress bandwidth for sending logs to the cloud

The cloud SIEM's ability to integrate with their existing EDR

The cloud SIEM's ability to ingest logs via a secure, high-throughput API

A SIEM is receiving logs from a Windows server and a Linux server. The Windows logs use Event ID 4625 for failed logons, while the Linux logs use 'Failed password'. What must the SIEM do to allow a single correlation rule to detect failed logons from both sources?

Convert the Linux logs to Windows Event IDs

Normalize both log types into a common event category

Store the logs in separate indexes

Create two separate correlation rules

EC-CouncilSOC Essentials

Domain 4Objective 4

SIEM Deployment Models and Data Sources SCE Practice Questions (Page 5)

Part of the SOC Components and Architecture domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

4concepts

Questions 21–25

21application · medium
A SOC wants to automatically block an IP address at the firewall when the SIEM detects a malicious scan. Which integration is required?
Select an answer first
22application · medium
A SOC analyst is configuring a SIEM to detect unauthorized access attempts across the network. Which combination of data sources would provide the most comprehensive visibility for this use case?
Select an answer first
23foundation · easy
Which of the following is a common data source category that a SIEM collects logs from?
Select an answer first
24expert · hard
A company is considering moving from an on-premises SIEM to a cloud-based SIEM. They have a highly regulated workload that requires low-latency access to logs for real-time alerting. Their internet connection is reliable but has a 50ms latency to the cloud region. The SOC is concerned about the impact on real-time detection. Which factor is most important to evaluate?
Select an answer first
25application · medium
A SIEM is receiving logs from a Windows server and a Linux server. The Windows logs use Event ID 4625 for failed logons, while the Linux logs use 'Failed password'. What must the SIEM do to allow a single correlation rule to detect failed logons from both sources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.