SIEM Use Case Development SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC is building a use case to detect an attacker using PowerShell to download and execute a payload from an external URL. They have Windows Event logs, PowerShell script block logs, and proxy logs. Which data source and field combination is most essential for this use case?

   • ADNS logs — specifically the resolved IP address of the domain
   • BWindows Event logs — specifically Event ID 4688 with the command line
   • CPowerShell script block logs — specifically the script block text and the invoked URL
   • DProxy logs — specifically the destination URL and user agent
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A SOC analyst is developing a use case to detect a supply-chain attack where a legitimate software update is compromised. The organization has software inventory logs, file integrity monitoring (FIM) logs, and network logs. Which threat scenario should the use case focus on to best detect this attack?

   • AA sudden increase in network traffic to a software vendor's domain.
   • BA legitimate software update process that triggers a file integrity alert on a critical system file.
   • CA new software version being installed on multiple endpoints.
   • DA user downloading a software update from an external website.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC analyst is tasked with building a SIEM use case to detect internal reconnaissance where an attacker enumerates SMB shares across multiple hosts. The analyst has access to Windows Security logs, DNS logs, and firewall logs. Which approach best aligns with the use case development process?

   • ACreate a correlation rule that triggers when a single source IP performs SMB session setup failures against more than 10 distinct destination IPs within 5 minutes.
   • BConfigure a rule that triggers when any host performs more than 100 outbound connections to port 445 in an hour.
   • CBuild a rule that alerts on any SMB-related event from a single host, regardless of destination count or time window.
   • DUse DNS logs to detect SMB enumeration by looking for unusual DNS queries for SMB service records.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SIEM rule that detects multiple failed logons followed by a successful logon is producing a high number of false positives because a specific application service account regularly locks out. The account is known to be non-interactive and is used by a legacy system. How should the analyst tune this use case?

   • ADisable the rule because the service account is not a real threat
   • BIncrease the failed logon threshold to 20 attempts for all accounts
   • CChange the rule to only alert on successful logons after failures, ignoring the failure count
   • DAdd an exclusion filter for the service account's username and re-test the rule with a simulated attack
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of threat modeling in the context of SIEM use case development?

   • ATo identify relevant threat scenarios that should be detected by the SIEM
   • BTo simulate attacks against the SIEM infrastructure itself
   • CTo design the network architecture for the SOC
   • DTo calculate the risk score of every alert generated by the SIEM
   Reveal Solution Discussion Select an answer first