Data Source Assessment and Collection GSOM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which data source provides the most detailed information about the execution of a specific process on a single host?

   • AFirewall logs
   • BDNS logs
   • CPacket captures
   • DEndpoint telemetry
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is integrating a new data source into their SIEM: a cloud access security broker (CASB) that logs user activity in SaaS applications. The team wants to correlate these logs with existing on-premises Active Directory (AD) logs to detect compromised accounts. The CASB logs include the user's email address, while the AD logs use the user's SAM account name. What is the most effective way to enable correlation between these two data sources?

   • ACreate a lookup table in the SIEM that maps email addresses to SAM account names, and use it to enrich the CASB logs.
   • BModify the AD logs to include the email address for each user.
   • CModify the CASB to log the SAM account name instead of the email address.
   • DStore the CASB and AD logs in separate indexes and manually correlate them during investigations.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a data source specifically used to capture network-level communication patterns between hosts, including IP addresses, ports, and protocols?

   • AAuthentication logs
   • BNetwork flow logs
   • CVulnerability scan reports
   • DEndpoint telemetry
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security operations team is integrating multiple data sources into a SIEM. They have network flow logs, endpoint telemetry, and threat intelligence feeds. The team wants to create a correlation rule that detects a known malicious IP address communicating with an internal host. What is the most important integration step to enable this correlation?

   • AStore the threat intelligence feeds in a separate database.
   • BEnsure that the IP address field is normalized across all data sources.
   • CUse a single collection agent for all data sources.
   • DIncrease the retention period for network flow logs.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security team wants to collect logs from a cloud-based SaaS application that provides an interface for exporting event data. Which collection method is most appropriate?

   • AAgent-based collection
   • BNetwork packet capture
   • CAPI-based collection
   • DAgentless collection
   Reveal Solution Discussion Select an answer first