Log Analysis and Alerting GCDA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In a SIEM, what does the severity level of an alert typically indicate?

   • AThe time it took for the alert to be generated
   • BThe number of logs that triggered the alert
   • CThe type of log source that generated the alert
   • DThe potential impact or urgency of the detected event
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SIEM rule alerts when a user creates a new account and then adds it to a privileged group within 1 hour. The rule is producing many false positives because help desk staff routinely create accounts and add them to groups as part of onboarding. The security team wants to reduce noise while still detecting unauthorized privilege escalation. The help desk uses a specific service account for these tasks. Which tuning approach is most effective?

   • ADisable the rule and rely on manual audits of account creations
   • BChange the rule to alert only when the new account is added to the Domain Admins group
   • CIncrease the time window from 1 hour to 24 hours
   • DExclude the help desk service account from the rule
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SIEM rule alerts on any outbound connection to a known malicious domain. The rule has generated 50 alerts in the past week, but only 2 were confirmed as true positives. The false positives are all from a specific business unit that uses a web filtering service that performs SSL inspection and connects to the domain for categorization checks. What is the best tuning action?

   • AChange the rule to alert only on connections from non-business-unit hosts.
   • BAdd an exception for the web filtering service's source IPs in the rule.
   • CIncrease the alert severity to force analysts to investigate every alert.
   • DDisable the rule because it has a high false-positive rate.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A correlation rule detects multiple failed logins followed by a successful login from the same source IP. The rule currently sends an email to the security team. The team wants to ensure that high-severity alerts are handled quickly even outside business hours. Which configuration change best addresses this?

   • ASet the alert severity to 'high' and configure an escalation policy that pages the on-call analyst after 15 minutes if the alert is not acknowledged
   • BIncrease the correlation rule's time window to 1 hour
   • CDisable the rule during non-business hours
   • DSend the alert to a shared mailbox and hope someone checks it
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SIEM correlation rule triggers an alert when a user logs in from a foreign country and then performs a privileged action within 1 hour. The alert is set to severity 'high' and sends an email to the security operations team. The team is missing these alerts because they are buried in a shared inbox. What is the most effective way to ensure these alerts are noticed and acted upon?

   • AConfigure the rule to also create a ticket in the incident management system with a priority of 'high'
   • BDisable the rule and review logs manually at the end of each day
   • CIncrease the severity to 'critical' so the email subject line stands out
   • DSend the email to a distribution list that includes all managers
   Reveal Solution Discussion Select an answer first