Log Management & SIEM GSEC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SIEM correlation rule is designed to detect a possible credential stuffing attack by alerting when the same source IP attempts to log in with multiple different usernames. The rule is not firing even though the attack is occurring. The analyst has verified that the logs are being ingested and the rule is enabled. What is the most likely cause?

   • AThe SIEM is not receiving logs from the authentication server.
   • BThe usernames are normalized to lowercase, but the rule expects mixed case.
   • CThe rule's time window is too short.
   • DThe log source does not include the source IP field, so the rule cannot group by IP.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analyst receives a SIEM alert indicating a possible privilege escalation on a server. To confirm whether the alert is a true positive, which action should the analyst take first?

   • AImmediately block the user's account.
   • BDisable the correlation rule that generated the alert.
   • CEscalate the alert to law enforcement.
   • DReview the raw logs and the user's activity timeline around the alert time.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is migrating from on-premises servers to a cloud provider. The security team needs to ensure that logs from both environments are collected and normalized in the SIEM. The cloud provider offers a native logging service, while on-premises servers use syslog. What is the most efficient approach?

   • AUse the cloud provider's native logging service for cloud resources and a syslog collector for on-premises servers, then forward both to the SIEM.
   • BInstall the same agent on both cloud and on-premises servers.
   • COnly collect logs from the cloud environment.
   • DUse separate SIEMs for cloud and on-premises logs.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company runs a mix of Linux servers, Windows workstations, and network appliances. The security team needs to centralize logs for analysis. The network appliances only support syslog, while the Windows workstations need to send logs without installing third-party software. Which approach best meets these requirements?

   • AEnable syslog on Windows workstations and forward to the same server.
   • BUse only Windows Event Forwarding for all devices.
   • CConfigure a syslog server and enable Windows Event Forwarding (WEF) to forward events to it.
   • DInstall a third-party agent on all devices to collect and forward logs.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SIEM analyst notices that a correlation rule triggers an alert every time a user fails to log in three times within five minutes. The help desk receives many alerts for legitimate users who mistype their passwords. The analyst wants to reduce false positives while still detecting brute-force attacks. Which change is most appropriate?

   • ADisable the correlation rule entirely.
   • BChange the time window to 1 minute.
   • CIncrease the threshold to 10 failed attempts within 5 minutes.
   • DLower the threshold to 2 failed attempts within 5 minutes.
   Reveal Solution Discussion Select an answer first