Log Management & SIEM GSEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SIEM correlation rule is designed to detect a potential brute-force attack by alerting when the same user account fails to log in 5 times within 5 minutes. The rule is generating a high number of false positives because a legacy application retries authentication automatically. The SOC wants to reduce false positives without missing real attacks. Which modification is most effective?

   • ADisable the rule and create a new rule that alerts on successful logins after failures.
   • BIncrease the threshold to 20 failures within 5 minutes.
   • CAdd a filter to exclude failed logins from the legacy application's service account.
   • DChange the rule to alert only when failures come from multiple different source IPs.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which SIEM component is primarily responsible for identifying relationships between seemingly unrelated events?

   • ALog parser
   • BCorrelation engine
   • CDashboard widget
   • DData collection agent
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of a security-focused log source commonly used in log management?

   • AEmployee timesheet logs
   • BBuilding access control logs
   • CWeb server access logs
   • DPrinter spooler logs
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations center (SOC) is overwhelmed by SIEM alerts, many of which are false positives. The team wants to improve detection accuracy without increasing staffing. Which combination of actions would be most effective?

   • AIncrease the number of correlation rules to catch more events.
   • BTune correlation rules to reduce false positives and implement alert prioritization based on asset criticality.
   • CDisable all correlation rules and rely on manual log review.
   • DCollect more log sources to increase visibility.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SIEM is receiving logs from a firewall that uses a proprietary format. The security team wants to create a correlation rule that checks for multiple failed login attempts from the same source IP. What must be done before the rule can work effectively?

   • AParse and normalize the firewall logs to extract the source IP and login failure fields.
   • BWrite the correlation rule using the raw log format.
   • CManually review the firewall logs for failed logins.
   • DIncrease the SIEM's storage capacity.
   Reveal Solution Discussion Select an answer first