SIEM Overview GCDA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices that a single failed login is common, but multiple failed logins across different hosts within a short time may indicate a brute-force attack. They want the SIEM to alert only when the pattern is detected. What should they configure?

   • AA parser that extracts the username from each failed login event.
   • BA report that lists all failed login events daily.
   • CA correlation rule that aggregates failed login events across hosts and triggers when the threshold is exceeded.
   • DAn alert on every failed login event.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In a typical SIEM architecture, which component is responsible for receiving raw logs from various sources and forwarding them to the SIEM platform?

   • ACollector
   • BCorrelation engine
   • CParser
   • DStorage
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A security analyst needs to provide a weekly summary of all security incidents to the management team. The summary should include the number of alerts, the types of attacks detected, and the response actions taken. What is the most efficient way to generate this summary using the SIEM?

   • AManually review all alerts from the past week and compile the summary in a spreadsheet.
   • BConfigure a real-time alert that sends a notification for each incident, and then compile the notifications at the end of the week.
   • CUse a correlation rule to detect incidents and store them in a separate index, then query that index manually.
   • DCreate a scheduled report that queries the SIEM for alert data and incident response actions, and formats it into a summary.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SIEM generates an alert for a potential malware infection. The alert is assigned a high priority, but the incident response team is overwhelmed with alerts and misses this one. What is the most effective way to improve the situation?

   • ARefine the correlation rules to reduce false positives and tune alert prioritization.
   • BIncrease the priority of all alerts to ensure they are noticed.
   • CDisable the alert and rely on manual log review.
   • DSend all alerts to a separate email distribution list.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of a Security Information and Event Management (SIEM) system?

   • ATo automatically patch vulnerabilities in operating systems
   • BTo replace the need for a dedicated firewall and intrusion prevention system
   • CTo store all network traffic for forensic analysis
   • DTo centralize security event collection, correlation, and analysis from multiple sources
   Reveal Solution Discussion Select an answer first