A detection engineer wants to create a rule that detects a potential brute-force attack on a web application. The rule should trigger when a single source IP sends many HTTP 401 responses to the web server. Which log source and field combination is most appropriate?

Windows Security logs with fields for user and event ID

Web server access logs with fields for client IP and HTTP status code

Firewall logs with fields for source and destination port

DNS logs with fields for query name and response code

A security analyst is reviewing logs from a web server, a firewall, and a Linux host. Which statement correctly describes a common characteristic of these log sources?

Network device logs are always in binary format, while application logs are always in plain text.

Each source has a distinct format and purpose, but all can provide valuable clues for security analysis.

Operating system logs are the only source that can be used to detect unauthorized access attempts.

All three sources produce logs in the same standardized format, such as JSON, by default.

A SOC team has a correlation rule that triggers an alert whenever a user fails to authenticate 5 times within 10 minutes. The alert severity is set to 'high' and it pages the on-call analyst. Recently, the team has been overwhelmed by alerts from a legacy application that uses a service account which retries authentication every minute. What is the most effective immediate action to reduce noise while preserving detection of actual brute-force attacks?

Change the alert severity to 'medium' so it does not page the on-call analyst.

Disable the rule temporarily until the legacy application is patched.

Exclude the legacy service account from the rule and keep the threshold at 5 failures in 10 minutes.

Increase the threshold to 10 failures in 10 minutes for all accounts.

A SIEM rule alerts on any process that creates a scheduled task. The rule has a high false-positive rate because many legitimate software updates create scheduled tasks. The SOC wants to reduce noise while still detecting malicious scheduled task creation. Which tuning approach is most effective?

Set the rule to 'informational' severity so that analysts can ignore the alerts.

Change the rule to alert only when the scheduled task is created with SYSTEM privileges.

Add a filter to exclude scheduled task creation by known software update processes.

Increase the rule's time window to 1 hour so that only sustained activity triggers an alert.

A SIEM correlation rule is designed to detect port scanning by alerting when one source IP connects to more than 100 distinct destination ports on a single host within 5 minutes. The security team is overwhelmed by alerts from a vulnerability scanner that runs weekly. The analyst wants to reduce false positives without losing detection of real scans. Which tuning change is most effective?

Change the rule to alert on any connection to a single port

Disable the rule during the weekly scanner window

Increase the threshold to 1000 ports within 5 minutes

Add the vulnerability scanner's IP address to an exclusion list in the rule

GIAC Certified Detection Analyst

Domain 1Objective 3

Log Analysis and Alerting GCDA Practice Questions (Page 7)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31application · easy
A detection engineer wants to create a rule that detects a potential brute-force attack on a web application. The rule should trigger when a single source IP sends many HTTP 401 responses to the web server. Which log source and field combination is most appropriate?
Select an answer first
32foundation · easy
A security analyst is reviewing logs from a web server, a firewall, and a Linux host. Which statement correctly describes a common characteristic of these log sources?
Select an answer first
33application · medium
A SOC team has a correlation rule that triggers an alert whenever a user fails to authenticate 5 times within 10 minutes. The alert severity is set to 'high' and it pages the on-call analyst. Recently, the team has been overwhelmed by alerts from a legacy application that uses a service account which retries authentication every minute. What is the most effective immediate action to reduce noise while preserving detection of actual brute-force attacks?
Select an answer first
34application · medium
A SIEM rule alerts on any process that creates a scheduled task. The rule has a high false-positive rate because many legitimate software updates create scheduled tasks. The SOC wants to reduce noise while still detecting malicious scheduled task creation. Which tuning approach is most effective?
Select an answer first
35application · medium
A SIEM correlation rule is designed to detect port scanning by alerting when one source IP connects to more than 100 distinct destination ports on a single host within 5 minutes. The security team is overwhelmed by alerts from a vulnerability scanner that runs weekly. The analyst wants to reduce false positives without losing detection of real scans. Which tuning change is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Log Analysis and Alerting GCDA Practice Questions (Page 7)

Questions 31–35

A detection engineer wants to create a rule that detects a potential brute-force attack on a web application. The rule should trigger when a single source IP sends many HTTP 401 responses to the web server. Which log source and field combination is most appropriate?

A security analyst is reviewing logs from a web server, a firewall, and a Linux host. Which statement correctly describes a common characteristic of these log sources?

A SIEM rule alerts on any process that creates a scheduled task. The rule has a high false-positive rate because many legitimate software updates create scheduled tasks. The SOC wants to reduce noise while still detecting malicious scheduled task creation. Which tuning approach is most effective?

Keep studying — SIEM Foundations