Log Analysis and Alerting GCDA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security team wants to detect a potential data exfiltration scenario where a user downloads a large file from an internal server and then uploads it to an external cloud storage service. The SIEM has logs from the internal file server, the web proxy, and the firewall. The team wants to create a correlation rule that minimizes false positives. Which rule logic is most effective?

   • AAlert when any user uploads to an external cloud storage service
   • BAlert when the same user downloads a file from the internal server and then uploads to an external cloud storage service within 30 minutes
   • CAlert when a user downloads a file from the internal server
   • DAlert when the firewall logs show a connection to a known cloud storage IP
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   A detection engineer is building a correlation rule to identify data exfiltration via DNS. The rule needs to detect when a client sends a large number of DNS queries for unique subdomains under a single domain. Which log source is most appropriate for this rule?

   • AWindows Security Event Logs
   • BWeb server access logs
   • CDNS server logs
   • DNetFlow records
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An organization wants to ensure that critical security alerts are seen by on-call staff even outside business hours. Which alerting mechanism is most appropriate?

   • AA log entry in the SIEM's internal database
   • BA daily summary report sent by email
   • CAn SMS or push notification to the on-call analyst
   • DA weekly review meeting
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC has a rule that generates an alert for any successful login outside business hours. The alert is configured with severity 'medium' and sends an email to the SOC mailbox. The team has noticed that many alerts are for legitimate remote workers in different time zones. What is the most appropriate adjustment to the alerting configuration?

   • AChange the rule to use the user's local timezone instead of the SIEM's timezone when evaluating business hours.
   • BChange the notification method to SMS instead of email to ensure faster response.
   • CDisable the rule because it is generating too many false positives.
   • DIncrease the severity to 'high' so the alerts are more visible to the on-call team.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is ingesting logs from multiple sources, including Windows Event Logs, Linux syslog, and custom application logs. The SIEM normalizes all logs into a common schema. A correlation rule is written to detect a user who logs in from a new device. The rule uses the 'user' and 'device' fields. Which normalization step is essential for this rule to work correctly across all log sources?

   • AMap the user and device fields from each log format to the common 'user' and 'device' fields.
   • BConvert all logs to a single format, such as JSON, before ingestion.
   • CStore the raw logs in their original format and run the rule against each source separately.
   • DEnsure that all logs include a timestamp in the same timezone.
   Reveal Solution Discussion Select an answer first