Log Analysis and Alerting GCDA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company collects logs from Linux servers, Windows servers, and network appliances. The SIEM is receiving them in different formats: syslog for Linux, Windows Event Log for Windows, and vendor-specific formats for network devices. The detection team wants to write a single correlation rule that checks for failed login attempts across all sources. What should be done to enable this rule?

   • AUse a single collection agent on all devices to force identical log formats
   • BConfigure the SIEM to normalize all logs into a common schema with standardized field names such as 'src_ip' and 'event_type'
   • CWrite separate correlation rules for each log source and manually combine the results
   • DConvert all logs to JSON format before sending them to the SIEM
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During alert triage, what is the primary goal when determining whether an alert is a false positive?

   • ATo confirm the alert was generated by a legitimate user action
   • BTo escalate the alert to a higher severity level
   • CTo change the SIEM's time zone settings
   • DTo delete the underlying log data
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A SIEM rule generates a high volume of alerts for a routine administrative activity. What is the most effective way to reduce this noise while still detecting genuine threats?

   • AAdd an exception or filter to exclude the known benign activity
   • BIncrease the severity of the rule
   • CDisable the rule entirely
   • DChange the alert destination to a different email address
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC is investigating a series of alerts where a user's account is locked out multiple times, followed by a successful login from a different country. The SIEM has a rule that triggers on account lockouts and another rule that triggers on impossible travel. The team is receiving duplicate alerts for the same incident. What is the most effective way to reduce alert fatigue while maintaining detection fidelity?

   • ACreate a new correlation rule that requires both an account lockout and a subsequent successful login from a different country within a defined time window, and suppress the individual alerts when the combined rule fires.
   • BIncrease the severity of both rules so that analysts prioritize them equally.
   • CDisable the account lockout rule and keep only the impossible travel rule.
   • DSet a longer suppression window for the impossible travel rule so it does not fire after a lockout.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is ingesting logs from a custom application that writes timestamps in a non-standard format (e.g., '2025-03-01 14:30:22 UTC'). The SIEM is unable to correlate these events with other logs because the timestamp field is not recognized. What is the most effective way to fix this?

   • AIgnore the timestamp and rely on the SIEM's ingestion time
   • BAsk the application developers to change the log format to match the SIEM's default
   • CStore the logs in a separate index without parsing
   • DConfigure a parsing rule in the SIEM to extract and convert the timestamp into the standard timestamp format
   Reveal Solution Discussion Select an answer first