A SIEM rule that detects a single user logging into more than five different workstations within an hour is generating false positives because a help desk account legitimately accesses many machines. The help desk account is a shared account used by multiple technicians. What is the best tuning approach?

Disable the rule because the help desk account is a false positive source

Change the rule to alert only when the user logs into workstations in different geographic locations

Increase the threshold to ten workstations for all accounts

Exclude the help desk account from the rule and re-test with a simulated lateral movement scenario

A SOC analyst is creating a correlation rule to detect a DDoS attack targeting a public web server. The available data includes NetFlow records, web server access logs, and firewall logs. Which correlation logic is most effective for detecting a volumetric DDoS attack?

Alert when the number of connections to the web server from a single source IP exceeds a threshold within a minute

Alert when the web server returns a high number of 500 errors

Alert when the total inbound traffic volume to the web server exceeds a baseline threshold for a sustained period

Alert when a single user agent is observed in more than 100 requests per minute

Which action is an example of tuning a SIEM use case?

Increasing the threshold for failed logins from 5 to 10 within 10 minutes

Deleting the use case because it is not working

Creating a new dashboard for alert visualization

Adding a new log source to the SIEM

A SOC team is building a use case to detect unauthorized use of administrative privileges. They have Active Directory logs, Windows Security logs, and VPN logs. Which data source is most critical for this use case?

VPN logs, because they show remote access to the network.

Active Directory logs, because they show changes to group memberships.

All three sources are equally critical.

Windows Security logs, because they contain privilege use events such as event ID 4672 (special privileges assigned to new logon).

What is the purpose of tuning a SIEM use case?

To increase the number of alerts generated by the SIEM

To change the log sources used by the SIEM

To delete use cases that are no longer needed

To adjust thresholds and filters to reduce false positives and improve detection accuracy

EC-CouncilSOC Essentials

Domain 6Objective 1

SIEM Use Case Development SCE Practice Questions (Page 5)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

Questions 21–25

21application · medium
A SIEM rule that detects a single user logging into more than five different workstations within an hour is generating false positives because a help desk account legitimately accesses many machines. The help desk account is a shared account used by multiple technicians. What is the best tuning approach?
Select an answer first
22application · medium
A SOC analyst is creating a correlation rule to detect a DDoS attack targeting a public web server. The available data includes NetFlow records, web server access logs, and firewall logs. Which correlation logic is most effective for detecting a volumetric DDoS attack?
Select an answer first
23foundation · easy
Which action is an example of tuning a SIEM use case?
Select an answer first
24application · medium
A SOC team is building a use case to detect unauthorized use of administrative privileges. They have Active Directory logs, Windows Security logs, and VPN logs. Which data source is most critical for this use case?
Select an answer first
25foundation · easy
What is the purpose of tuning a SIEM use case?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.