Log Analysis and Alerting GCDA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is triaging an alert that fired when a user logged in from an IP address that is on a threat intelligence blocklist. The alert severity is 'medium'. The analyst checks the user's recent activity and sees that the user is currently on vacation and has not logged in from that IP before. What is the most appropriate action?

   • ADisable the user's account and wait for the user to return
   • BClose the alert as a false positive because the user is on vacation
   • CIgnore the alert because the user is on vacation and cannot be logging in
   • DEscalate the alert to incident response as a potential account compromise
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company ingests logs from multiple sources: Windows Event Logs, Linux syslog, and custom application logs in JSON format. The SIEM normalizes all logs into a common schema with fields like 'src_ip', 'user', and 'event_type'. A correlation rule is written to detect multiple failed logins from the same source IP. Which normalization step is essential for this rule to work correctly across all log sources?

   • AConvert all logs to a single format, such as JSON, before ingestion.
   • BMap the source IP field from each log format to the common 'src_ip' field.
   • CEnsure that all logs include a timestamp in the same timezone.
   • DStore the raw logs in their original format and run the rule against each source separately.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary function of a correlation rule in a SIEM?

   • ATo collect logs from multiple sources into a central repository
   • BTo combine multiple log events based on defined logic to identify suspicious patterns
   • CTo store logs for long-term compliance
   • DTo normalize log formats into a common schema
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An alert fires for a suspicious PowerShell command that downloads an executable from a known malicious IP. The alert includes the hostname, username, and the full command line. During triage, the analyst checks the host's recent logon events and sees that the user logged in interactively 30 minutes before the alert. The user is a system administrator. Which initial triage action is most appropriate?

   • ATreat the alert as a true positive and immediately isolate the host from the network.
   • BEscalate the alert to incident response without any further analysis because the IP is known malicious.
   • CClose the alert as a false positive because the user is a system administrator and has legitimate access.
   • DCheck whether the PowerShell command matches any known administrative scripts used by the IT team.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SIEM correlation rule detects a potential ransomware pattern: a user encrypting many files in a short period. The rule is set to severity 'critical' and sends an email to the security team. The team wants to ensure that this alert is acted upon immediately, even if the primary analyst is unavailable. Which configuration is most effective?

   • AIncrease the severity to 'critical' and add a second email recipient
   • BSend the alert to a distribution list with all team members
   • CConfigure an escalation policy that pages the on-call analyst after 5 minutes if the alert is not acknowledged
   • DDisable the rule during non-business hours
   Reveal Solution Discussion Select an answer first