SIEM Overview GCDA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small company currently reviews logs from each server individually. They want to identify attacks that span multiple systems. What is the primary benefit of deploying a SIEM in this scenario?

   • AReplacing all existing security tools with a single product.
   • BCentralized collection and correlation of logs from multiple sources.
   • CStoring logs in their original format without any processing.
   • DEliminating the need for manual log review entirely.
   Reveal Solution Discussion Select an answer first
2. 27application · easy

   A small company currently stores security logs from its firewall, Windows servers, and Linux servers in separate files on each device. The security team wants to be able to search across all logs for a single user's activity during an investigation. What is the primary benefit of implementing a SIEM for this scenario?

   • AIt eliminates the need for the security team to review logs manually, as it automatically blocks malicious activity.
   • BIt centralizes the logs into a single repository and normalizes them into a common format, enabling cross-source searches.
   • CIt replaces the need for individual device logs, so the original sources can be decommissioned.
   • DIt provides a direct connection to the firewall to change rules in real time during an investigation.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SIEM administrator is troubleshooting why a correlation rule is not firing. The rule is designed to detect multiple failed logins followed by a successful login from the same source IP. The administrator confirms that the events are being collected and stored. What is the most likely cause of the rule not firing?

   • AThe report that summarizes the events is not scheduled to run, so the rule has no data to process.
   • BThe events are not being normalized into a common schema, so the correlation engine cannot match fields like source IP and event type across different log sources.
   • CThe alerting mechanism is not configured to send notifications, so the rule fires but no one is notified.
   • DThe storage capacity is full, so new events are being dropped before they reach the correlation engine.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of alert prioritization in a SIEM?

   • ATo automatically patch vulnerabilities
   • BTo ensure that the most critical alerts are addressed first
   • CTo reduce the storage space required for alerts
   • DTo normalize alert data
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is creating a detection for a specific threat scenario: an attacker who gains access to a web server and then attempts to move laterally to a database server. The analyst wants to ensure the detection is specific to this scenario and not triggered by normal administrative activity. What is the best approach?

   • ACreate a correlation rule that requires a successful login to the web server followed by a connection attempt to the database server from the same source IP within a short time window.
   • BCreate a rule that alerts on any connection attempt to the database server from any source.
   • CCreate a report that lists all logins to the web server and all connections to the database server for manual review.
   • DCreate a rule that alerts on any successful login to the web server.
   Reveal Solution Discussion Select an answer first