SIEM Deployment Models and Data Sources SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SIEM is receiving logs from multiple sources, but the field names for IP addresses differ (e.g., src_ip, source_address, SRC). An analyst writes a correlation rule that only uses 'src_ip'. What is the likely result?

   • AThe rule will generate an error
   • BThe rule will miss events that use different field names
   • CThe rule will cause a performance issue
   • DThe rule will work correctly because the SIEM automatically maps fields
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company with a mature on-premises SIEM wants to add cloud-based threat intelligence feeds and automated response capabilities without moving its existing log storage. Which deployment model would allow this while preserving the existing SIEM investment?

   • AHybrid SIEM with cloud-based enrichment and response
   • BFull migration to a cloud-based SIEM
   • CUse a separate cloud SIEM for threat intelligence only
   • DKeep the on-premises SIEM and add no cloud services
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SIEM is configured to collect logs from a network device that only supports syslog. What is the most common method for the SIEM to receive these logs?

   • AThe SIEM reads the device's configuration file
   • BThe SIEM polls the device via SNMP
   • CThe SIEM listens on a UDP or TCP port for syslog messages
   • DThe SIEM uses an API to pull logs
   Reveal Solution Discussion Select an answer first
5. 34application · hard

   A multinational company operates data centers in the EU and the US. They must keep EU customer data within the EU for compliance. They want a single SIEM view for their global SOC. Which deployment model best meets these requirements?

   • AAn on-premises SIEM in the US that uses a VPN to collect EU logs in real time
   • BA hybrid SIEM with an EU-region cloud SIEM for EU data and a US-region cloud SIEM for US data, with a federated search capability that queries both without moving data
   • CTwo separate on-premises SIEMs, one in the EU and one in the US, with no data sharing
   • DA single cloud-based SIEM in the US region that collects logs from both EU and US data centers
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is deploying a SIEM and has a limited budget. They have two data sources: a legacy mainframe that only supports syslog over UDP and a modern cloud application that sends JSON logs via HTTPS. The SIEM vendor charges per GB ingested. The mainframe generates 500 GB/day of verbose syslog, while the cloud app generates 10 GB/day of high-value security logs. The SOC wants to maximize detection value within budget. What should they do?

   • AIngest only the cloud app logs and ignore the mainframe entirely
   • BIngest all mainframe syslog but only a random 10% sample of cloud app logs
   • CIngest all mainframe syslog and all cloud app logs, and increase the budget
   • DConfigure the mainframe to send only security-relevant logs (e.g., authentication and access control) and ingest all cloud app logs
   Reveal Solution Discussion Select an answer first