Log Analysis and Alerting GCDA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the typical goal of adjusting a correlation rule's threshold (e.g., from 5 failed logins to 10 failed logins within 5 minutes)?

   • ATo change the log sources the rule analyzes
   • BTo make the rule run faster
   • CTo reduce false positives by requiring more events before alerting
   • DTo increase the severity of the alert
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A detection engineer is building a correlation rule to detect a single user account being used from multiple geographic locations within a short time window. The SIEM receives logs from VPN gateways, Active Directory authentication, and web proxies. Which combination of log sources and correlation logic is most appropriate for this rule?

   • AUse only web proxy logs to identify the user's source IP and correlate with VPN logs to confirm the same username, ignoring Active Directory logs because they lack geolocation data.
   • BUse Active Directory logs alone to determine the source IP and geolocation, since they contain the user's login location and timestamp.
   • CCorrelate VPN logs with web proxy logs using the same source IP, and if the IP appears in two different countries, trigger an alert for the user.
   • DUse VPN gateway logs for source IP and timestamp, correlate with Active Directory authentication logs for the same username within a 10-minute window, and require the geolocation of the source IPs to differ.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst notices that a single user account has been locked out multiple times in the past hour. The SIEM has authentication logs from domain controllers and a correlation rule that triggers on five or more failed logins within 10 minutes. The analyst wants to determine whether this is a brute-force attack or a user repeatedly mistyping their password. Which additional log source would provide the most useful context for this triage?

   • AWeb proxy logs for the user's browsing activity
   • BApplication logs from the email server
   • CFirewall logs showing the source IP addresses of the failed logins
   • DDNS query logs from the internal DNS server
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An alert fires for a possible data exfiltration: a user uploaded 2 GB of data to a cloud storage service within 10 minutes. The user is from the marketing department and frequently uploads large files for campaign assets. The analyst checks the user's past activity and sees similar uploads on a weekly basis. What is the most appropriate triage decision?

   • AClose the alert as a false positive because the behavior is consistent with the user's normal job function.
   • BDisable the user's account until the investigation is complete.
   • CEscalate the alert to incident response because the volume is large and could indicate data theft.
   • DIsolate the user's workstation immediately to prevent further data loss.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An analyst receives an alert for a potential malware download. During triage, which action is most appropriate to determine if the alert is a true positive?

   • AReview the associated logs to see if the file was actually downloaded and executed
   • BReinstall the SIEM software
   • CIgnore the alert because all alerts are false positives
   • DImmediately block the user's IP address
   Reveal Solution Discussion Select an answer first