A SIEM correlation rule triggers an alert whenever a user logs in from a new geographic location. The alert is configured with severity 'high' and sends an email to the security team. The team receives dozens of these alerts daily because users travel frequently. The analyst wants to reduce noise while still detecting genuinely suspicious logins. Which action is most appropriate?

Add a condition to the rule that excludes logins from countries where the company has offices

Change the alert delivery from email to SMS

Increase the severity to 'critical' so the team pays more attention

Disable the rule and rely on manual log review

A SIEM rule alerts when a user accesses more than 10 sensitive files within 5 minutes. The security team is seeing many alerts from a backup application that legitimately reads files in bulk. The analyst wants to reduce these false positives while keeping the rule effective for user-based data theft. Which tuning approach is best?

Change the rule to alert on any access to a sensitive file

Increase the threshold to 100 files within 5 minutes

Add the backup application's service account to an exclusion list in the rule

Disable the rule during backup windows

Which log source is most likely to contain a record of a user authenticating to a Windows domain controller?

Application log from a web server

Security log from the Windows domain controller

DNS query log from a recursive resolver

In a SIEM, what is the primary purpose of normalizing log data?

To delete duplicate log entries to save disk space

To convert logs into a consistent format that can be searched and correlated across different sources

To encrypt logs so they cannot be read by unauthorized parties

To compress logs to reduce storage costs

GIAC Certified Detection Analyst

Domain 1Objective 3

Log Analysis and Alerting GCDA Practice Questions (Page 1)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 1–5

1application · medium
A SIEM correlation rule triggers an alert whenever a user logs in from a new geographic location. The alert is configured with severity 'high' and sends an email to the security team. The team receives dozens of these alerts daily because users travel frequently. The analyst wants to reduce noise while still detecting genuinely suspicious logins. Which action is most appropriate?
Select an answer first
2application · medium
A SIEM rule alerts when a user accesses more than 10 sensitive files within 5 minutes. The security team is seeing many alerts from a backup application that legitimately reads files in bulk. The analyst wants to reduce these false positives while keeping the rule effective for user-based data theft. Which tuning approach is best?
Select an answer first
3foundation · easy
Which log source is most likely to contain a record of a user authenticating to a Windows domain controller?
Select an answer first
4foundation · easy
In a SIEM, what is the primary purpose of normalizing log data?
Select an answer first
5foundation · easy
A SIEM receives a raw log line from a network device. Which step in the processing pipeline is responsible for extracting fields such as source IP and destination port from that raw text?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Log Analysis and Alerting GCDA Practice Questions (Page 1)

Questions 1–5

Which log source is most likely to contain a record of a user authenticating to a Windows domain controller?

In a SIEM, what is the primary purpose of normalizing log data?

A SIEM receives a raw log line from a network device. Which step in the processing pipeline is responsible for extracting fields such as source IP and destination port from that raw text?

Keep studying — SIEM Foundations