SIEM Overview GCDA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying a SIEM and wants to ensure that logs from remote offices are collected reliably even if the central SIEM is temporarily unavailable. Which architecture component should they implement?

   • AA direct connection from each device to the central correlation engine.
   • BA reporting server that generates daily summaries.
   • CA single storage repository at the central site.
   • DLocal collectors or forwarders that buffer logs and forward them when connectivity is restored.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization must provide auditors with evidence that access to a critical system is monitored. They need a monthly summary of authentication events and anomalies. What is the best way to fulfill this requirement using the SIEM?

   • AConfigure a real-time alert for every authentication event.
   • BProvide auditors with direct access to the SIEM search interface.
   • CExport raw logs to a spreadsheet and email them monthly.
   • DCreate a scheduled report that summarizes authentication events and highlights anomalies.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security manager wants to demonstrate to the board that the SIEM is providing value by showing trends in security incidents over the past quarter. The manager also needs to show that the SIEM is meeting compliance requirements for log retention. What is the most appropriate way to present this information?

   • AProvide a live dashboard that shows real-time alerts and the current number of logs stored.
   • BExport all raw logs to a spreadsheet for the board to review.
   • CGenerate a scheduled report that includes charts of incident trends and a summary of log retention statistics.
   • DSend a daily email with the number of alerts generated and the storage usage.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a primary use of SIEM reports in a compliance context?

   • ATo store logs for long-term retention
   • BTo replace the need for external audits
   • CTo demonstrate that security controls are operating effectively
   • DTo automatically remediate compliance violations
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has a legacy on-premises application that writes security events to a local file in a proprietary format. The SIEM team needs to ingest these events for correlation with network-based detections. The application vendor does not provide an API or a standard syslog output. Which approach should the team use to get this data into the SIEM?

   • ADeploy a collector agent on the application server that tails the log file, parses the proprietary format, and forwards normalized events to the SIEM.
   • BHave the SIEM connect directly to the application's database to query the event table periodically.
   • CUse a network packet capture probe to infer the application's security events from its network traffic.
   • DConfigure the application to write logs in syslog format and send them directly to the SIEM's default syslog listener port.
   Reveal Solution Discussion Select an answer first