A SIEM is ingesting proxy logs that contain a URL field. Analysts want to extract the domain name from the URL to correlate with threat intelligence. What parsing technique should be used?

Store the entire URL and use substring searches in queries

Enrich the URL with geolocation data

Use a regex or parser to extract the domain from the URL field into a separate field

Normalize the URL to lowercase only

What is the primary purpose of normalizing raw logs in a SIEM?

To reduce the storage size of logs

To convert logs into a common schema for consistent analysis

To encrypt logs for secure transmission

To generate alerts based on log content

During parsing, a raw log line is broken into fields. What does parsing typically produce?

An encrypted version of the log

Key-value pairs of extracted fields

A compressed archive of the raw log

A visual dashboard of log trends

An organization is enriching logs with threat intelligence from a commercial feed. The feed is updated every 15 minutes, but the SIEM only enriches events at ingestion time. Analysts notice that some events are not enriched with the latest indicators. What is the best way to address this?

Use a different threat intelligence provider

Increase the frequency of the threat intelligence feed updates

Accept the limitation and rely on manual lookups

Re-enrich historical events when the threat intelligence feed is updated

A SOC analyst is investigating a series of failed logins from an external IP. The analyst wants to know if this IP has been observed in past incidents and whether it is associated with any known threat actor. Which enrichment source would provide this historical context?

Internal incident management system

GIAC Certified Detection Analyst

Domain 1Objective 2

Log Collection and Enrichment GCDA Practice Questions (Page 2)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 6–10

6application · medium
A SIEM is ingesting proxy logs that contain a URL field. Analysts want to extract the domain name from the URL to correlate with threat intelligence. What parsing technique should be used?
Select an answer first
7foundation · medium
What is the primary purpose of normalizing raw logs in a SIEM?
Select an answer first
8foundation · medium
During parsing, a raw log line is broken into fields. What does parsing typically produce?
Select an answer first
9expert · hard
An organization is enriching logs with threat intelligence from a commercial feed. The feed is updated every 15 minutes, but the SIEM only enriches events at ingestion time. Analysts notice that some events are not enriched with the latest indicators. What is the best way to address this?
Select an answer first
10application · medium
A SOC analyst is investigating a series of failed logins from an external IP. The analyst wants to know if this IP has been observed in past incidents and whether it is associated with any known threat actor. Which enrichment source would provide this historical context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.