Log Analysis and Alerting GCDA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is ingesting firewall logs that contain the source IP, destination IP, and port. The logs are in a proprietary format that the SIEM does not recognize. The SIEM has a built-in parser for common firewall vendors, but this vendor is not supported. What is the most appropriate step to enable analysis of these logs?

   • AUse a generic syslog parser and hope that the fields are extracted correctly.
   • BConvert the logs to CSV format using a script and then ingest them.
   • CIngest the logs as raw text and search for keywords manually.
   • DWrite a custom parser to extract the relevant fields and map them to the SIEM's common schema.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A correlation rule is designed to detect a brute-force attack. Which condition would the rule most likely use?

   • AA successful login followed by a logout
   • BMultiple failed login attempts for the same account within a short time window
   • CA change in the system time on the authentication server
   • DA single failed login event from any user
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SIEM has a correlation rule that triggers when a user logs in from a new device and then accesses a sensitive file share within 5 minutes. The rule is generating many alerts because users often switch devices. The analyst wants to reduce false positives while still detecting potential credential theft. Which change to the rule logic is most appropriate?

   • ARemove the sensitive file share access condition
   • BIncrease the time window from 5 minutes to 1 hour
   • CAdd a condition that the user must also have failed a login attempt earlier that day
   • DChange the rule to alert on any login from a new device regardless of file access
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC has a rule that alerts on any user who logs in from more than 3 different countries within a 24-hour period. The rule generates many false positives for employees who travel frequently. The SOC wants to reduce false positives without missing real impossible travel attacks. Which tuning approach is most effective?

   • AIncrease the threshold to 5 countries within 24 hours for all users.
   • BDisable the rule for users in the travel department.
   • CChange the rule to alert only when the login occurs from a country that is not in the user's allowed country list.
   • DAdd a baseline of each user's normal travel patterns and only alert when the number of countries exceeds the user's historical average by a significant margin.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SIEM rule is designed to detect lateral movement by alerting when a user logs into more than 5 different hosts within 10 minutes. The rule is generating a high volume of alerts from a legitimate automation tool that uses a service account to run scripts across many servers. The security team wants to reduce false positives without missing real lateral movement. The automation tool's IP addresses are known and static. Which tuning approach best balances detection and noise reduction?

   • AIncrease the threshold to 20 hosts within 10 minutes
   • BChange the rule to alert only when the source host is a domain controller
   • CDisable the rule during business hours when the automation tool runs
   • DAdd the automation tool's service account to an exclusion list in the rule
   Reveal Solution Discussion Select an answer first