SIEM Deployment Models and Data Sources SCE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC is investigating a potential data exfiltration. The SIEM shows a large outbound transfer from a server to an external IP. The firewall logs confirm the connection, but the EDR does not show any suspicious process on the server. The analyst suspects the EDR may have missed the activity. Which action is most appropriate to confirm or refute the exfiltration?

   • AIgnore the SIEM alert because the EDR is the authoritative source for endpoint activity
   • BCorrelate the firewall log with Windows security event logs to identify the process that initiated the connection
   • CConclude that the transfer was legitimate because the EDR did not flag it
   • DBlock the external IP immediately and close the investigation
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SIEM is receiving logs from multiple sources, but the timestamps are in different time zones and formats. What is the best practice to ensure accurate correlation?

   • AIgnore timestamps and rely on sequence numbers
   • BKeep the original timestamps and manually adjust during analysis
   • CUse the SIEM server's local time zone for all events
   • DConvert all timestamps to UTC during normalization
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A government agency is required to keep all security logs within its own data center for national security reasons. They also want to use a commercial SIEM's advanced analytics and machine learning capabilities. Which deployment model allows them to use the commercial SIEM while meeting the data-location requirement?

   • AAn on-premises deployment of the commercial SIEM software within the agency's data center
   • BA hybrid model where the SIEM analytics run in the cloud but only metadata is sent to the cloud
   • CA community cloud shared with other government agencies
   • DA cloud-based SIEM in the government's own cloud tenancy within the country's borders
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's SIEM is generating a high volume of alerts from a network IDS. The SOC is overwhelmed and missing critical alerts. The analyst wants to reduce noise while preserving detection of real threats. Which approach is most effective?

   • ARoute all IDS alerts to a separate SIEM that the SOC does not monitor
   • BDisable the IDS log source in the SIEM to stop the noise
   • CIncrease the IDS alert threshold to only report on high-severity signatures
   • DIntegrate EDR data into the SIEM and create correlation rules that only alert when an IDS event matches an EDR detection on the same host
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A retail company is deploying a SIEM. They want to detect brute-force attacks on their customer-facing web application and also correlate those events with suspicious logins to their internal HR system. Which set of data sources should they prioritize feeding into the SIEM?

   • AEDR alerts, antivirus logs, and patch management logs
   • BDNS logs, DHCP logs, and NetFlow data
   • CWeb server access logs, authentication logs from the HR application, and firewall logs
   • DDatabase transaction logs, backup logs, and storage system logs
   Reveal Solution Discussion Select an answer first