Log Management & SIEM GSEC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary goal of tuning correlation rules in a SIEM?

   • ATo increase the number of alerts generated
   • BTo make the SIEM run faster by disabling logging
   • CTo eliminate all alerts to reduce analyst workload
   • DTo reduce false positives while maintaining detection of true threats
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of a parsing task performed during log normalization?

   • ASetting a retention policy for the log
   • BGenerating an alert for a failed login
   • CExtracting the source IP address from a raw log line
   • DEncrypting the log data in transit
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC is receiving a high volume of alerts from a SIEM rule that triggers on any outbound connection to a known-bad IP address. The rule is accurate, but the volume is overwhelming the analysts. The SOC wants to reduce the number of alerts while still ensuring that each alert is investigated. What is the best approach?

   • ADisable the rule and rely on threat intelligence feeds.
   • BIncrease the alert threshold so that the rule only fires after 10 connections to the same bad IP.
   • CSend the alerts to a separate email inbox instead of the SIEM console.
   • DGroup alerts from the same source IP and destination IP into a single incident, and prioritize based on the number of connections.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) is overwhelmed by alerts from a SIEM correlation rule that triggers whenever any user fails three logins within 10 minutes. The rule was intended to detect brute-force attacks, but it fires constantly for a few users who frequently mistype passwords. Which change best reduces false positives while still detecting real brute-force attempts?

   • ADisable the rule and rely on manual log review.
   • BIncrease the threshold to 10 failed logins within 10 minutes for all users.
   • CAdd a correlation rule that alerts only when the failed logins come from different source IPs.
   • DCreate a baseline of typical failed-login counts per user and adjust the rule threshold dynamically or use a user-risk score.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization is subject to HIPAA, which requires retaining audit logs for at least six years. The organization currently stores all logs in the SIEM for one year and then deletes them. What should the organization do to achieve compliance?

   • AArchive logs to low-cost storage after one year and retain them for at least six years total.
   • BContinue deleting logs after one year because the SIEM is not subject to HIPAA.
   • CKeep logs in the SIEM for six years.
   • DReduce the log sources to lower storage needs.
   Reveal Solution Discussion Select an answer first