SIEM Use Case Development SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of data source mapping for a use case that detects brute-force attacks on Active Directory?

   • AMapping the firewall logs to the use case to identify network scans
   • BMapping the Windows Security event logs (e.g., Event ID 4625) to the use case
   • CMapping the DNS logs to the use case to detect domain generation algorithms
   • DMapping the web server access logs to the use case to detect SQL injection
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a correlation rule in a SIEM?

   • AA rule that defines how logs are stored and indexed
   • BA rule that filters out all false positive alerts
   • CA rule that automatically patches vulnerable systems
   • DA rule that combines multiple events or conditions to detect a specific attack pattern
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SIEM rule that detects a single user account logging in from two different geographic locations within 30 minutes is generating many false positives because users often connect through VPNs that terminate in different cities. The SOC wants to reduce false positives without losing detection of impossible travel. What is the best tuning approach?

   • ADisable the rule because impossible travel is not a reliable indicator
   • BIncrease the time window to 2 hours to allow for legitimate travel
   • CUse the VPN authentication log as a source to identify the actual user location before applying the geographic check
   • DExclude all VPN source IP addresses from the rule
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SIEM use case for detecting port scanning is triggering on every port scan, including low-and-slow scans that are not considered malicious by the SOC. The team wants to reduce noise while still detecting significant scanning activity. Which tuning approach is most effective?

   • ADecrease the threshold to catch even the smallest scan.
   • BRemove the time window so that any scan is detected.
   • CIncrease the threshold for the number of ports scanned and extend the time window.
   • DDisable the use case and rely on manual analysis of firewall logs.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC team is developing a new use case to detect insider threat behavior involving unusual access to sensitive files. They have identified the threat scenario and mapped the required log sources. However, they are unsure whether to test the rule in a staging environment or directly in production. The SOC has a mature testing environment that mirrors production data. What is the best approach?

   • ATest the rule in the staging environment with both known attack scenarios and normal user activity, then tune and deploy to production
   • BDeploy the rule directly to production because the staging environment is not identical to production
   • CDeploy to production but set the rule to 'alert only' mode for a week before enabling active alerts
   • DSkip testing and rely on the rule's logic being correct based on the threat model
   Reveal Solution Discussion Select an answer first