SIEM Overview GCDA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is deploying a SIEM and must decide between two approaches: (1) collect all logs and rely on the SIEM's correlation engine to detect threats, or (2) implement a separate log management system and only forward logs that match predefined rules. The team wants to detect unknown threats and maintain a complete audit trail. Which approach is more appropriate and why?

   • ACollect all logs but disable correlation to avoid false positives.
   • BUse a separate log management system and forward only alerts to the SIEM.
   • CCollect all logs into the SIEM, because correlation can identify unknown patterns and the full dataset supports auditing.
   • DForward only logs that match predefined rules, because this reduces storage costs.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC manager is reviewing the SIEM's alerting configuration. The team is receiving a high number of alerts for a specific correlation rule, but most are false positives. The rule is designed to detect a specific attack technique, and the team does not want to disable it entirely. What is the most effective way to reduce false positives while maintaining detection capability?

   • ARefine the correlation rule by adding additional conditions, such as requiring specific user accounts or excluding known benign source IPs.
   • BSet the rule to generate a report instead of an alert, so the SOC can review it daily.
   • CDisable the rule for a week and re-enable it later to see if the false positives decrease.
   • DIncrease the alert priority so that the SOC only reviews the most critical alerts from this rule.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SIEM analyst is troubleshooting a correlation rule that is not firing. The rule depends on a field called 'user' that is extracted from Windows event logs. The analyst confirms that the events are being collected and that the field 'user' is present in the raw log. However, the rule still does not fire. What is the most likely cause?

   • AThe events are being stored in a different index than the rule is configured to search.
   • BThe SIEM is not receiving the events from the Windows server because the collector is misconfigured.
   • CThe parser for the Windows event log is not mapping the raw field 'user' to the normalized field 'user' that the correlation rule uses.
   • DThe correlation rule is using a different time window than the events are being indexed in.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A company is deploying a new web application and wants to ensure that its security logs are collected by the SIEM. The application runs on a Linux server and writes logs to a file. The SIEM team needs to collect these logs in near real-time. What is the most appropriate method?

   • AConfigure the application to send logs via email to the SIEM's email listener.
   • BHave the SIEM pull the log file from the server using FTP on a daily basis.
   • CUse a network sniffer to capture the application's log output from the network.
   • DInstall a SIEM agent on the Linux server that tails the log file and forwards new entries to the SIEM.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SIEM receives logs from multiple vendors. Each vendor uses a different timestamp format and field naming convention. The correlation team wants to write rules that work across all data sources. What should they implement first?

   • AA dedicated storage tier for each vendor's raw logs.
   • BA correlation rule that checks for multiple timestamp formats.
   • CA reporting dashboard that displays each vendor's logs separately.
   • DA parsing and normalization layer that maps vendor fields to a common schema.
   Reveal Solution Discussion Select an answer first