SIEM Overview GCDA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of event normalization in a SIEM?

   • ATo delete duplicate logs
   • BTo encrypt logs in transit
   • CTo compress logs to save storage space
   • DTo convert raw logs into a common schema for consistent analysis
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SIEM alert fires for a possible compromised account. The incident response team wants to contain the threat quickly, but the alert lacks context about which systems the account accessed. What is the best way to improve the alert's usefulness?

   • ADisable the alert until more context is available.
   • BIncrease the alert priority so the team responds faster.
   • CEnrich the correlation rule to include related authentication and access events in the alert details.
   • DSend the alert to a different team that might have more context.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A compliance team needs to prove that firewall configuration changes are reviewed. The SIEM collects firewall logs, but there is no change-management system. What is the most practical way to use the SIEM to support this audit requirement?

   • ADisable logging on the firewall to reduce noise.
   • BGenerate a report of firewall configuration change events and associate them with change tickets manually.
   • CConfigure an alert for every firewall change and ignore it.
   • DStore firewall logs in a separate archive for one year.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SIEM deployment is missing events from a specific application. The application writes logs to a local file. Which component is most likely needed to collect these logs?

   • AA collector or agent that reads the log file and forwards it to the SIEM.
   • BA storage expansion to hold more logs.
   • CA correlation rule that looks for the application's events.
   • DA parser that normalizes the application's logs.
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A SOC analyst receives an alert from the SIEM about a potential malware infection on a workstation. The alert is marked as 'high' priority. What is the most appropriate next step for the analyst?

   • AWait for a second alert to confirm the infection before taking any action.
   • BIgnore the alert because the SIEM may have generated a false positive.
   • CClose the alert without investigation because the SIEM is known to generate false positives.
   • DAcknowledge the alert and begin the incident response process, which may include isolating the workstation and investigating the alert.
   Reveal Solution Discussion Select an answer first