Log Collection and Enrichment GCDA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SIEM analyst is reviewing a DNS log entry and wants to know if the queried domain is associated with a known malicious campaign. The SIEM has a threat intelligence feed that includes domain reputation. What is the most effective way to use this feed?

   • AStore the threat intelligence feed separately and compare it during investigations.
   • BManually look up the domain on a public threat intel website.
   • CUse the feed to block the domain at the firewall.
   • DEnrich the DNS log with the threat intelligence feed's reputation score for the domain.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to automatically flag authentication events from IP addresses that are not in the organization's known network ranges. What enrichment technique should be applied?

   • ACorrelate with threat intelligence to identify malicious IPs
   • BTag events as 'external' when the source IP is not in the internal asset database
   • CUse geolocation to determine the country of the IP
   • DNormalize the IP field to a standard format
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SIEM engineer wants to tag all authentication events from a specific high-security subnet with a 'critical_asset' tag so that analysts can easily filter for them. The subnet is defined in the asset database. What is the most efficient way to apply this tag?

   • ACreate an enrichment rule that checks the source IP against the asset database and adds the tag if the subnet matches.
   • BUse a correlation rule to generate a separate alert for each event from the subnet.
   • CManually add the tag to each event as it arrives.
   • DAsk the network team to add a custom field to the authentication logs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SIEM engineer wants to automatically add the business unit and criticality of each internal asset to every authentication event. The asset information is stored in a CSV file that is updated weekly. Which enrichment technique should the engineer implement?

   • ACreate a correlation rule that queries the asset database when an alert fires.
   • BUse a parsing rule to extract business unit from the username field.
   • CConfigure a lookup enrichment that joins the asset CSV on the source IP field at ingestion time.
   • DManually add the business unit and criticality fields to each log entry.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SIEM administrator notices that events from a network device have timestamps in UTC, while events from Windows servers have timestamps in local time. Searches that correlate events across these sources are missing matches because the times do not align. What should the administrator do to ensure accurate correlation?

   • AConfigure the SIEM to convert all timestamps to a single timezone, such as UTC, during parsing.
   • BCreate separate searches for each timezone and manually combine the results.
   • CAdjust the search time range to be wider to account for the timezone differences.
   • DChange the Windows servers to log in UTC by modifying the system timezone.
   Reveal Solution Discussion Select an answer first