Data Source Assessment and Collection GSOM Practice Questions (Page 8)

Questions 36–37

1. 36foundation · easy

   Which activity is an example of validating that a data collection pipeline is working correctly?

   • AGenerating a test event and confirming it appears in the SIEM
   • BUpdating the antivirus signatures on endpoints
   • CChanging the SIEM vendor
   • DReviewing the SIEM dashboard color scheme
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team is integrating data from multiple sources into a centralized SIEM. The sources include firewall logs, endpoint detection and response (EDR) alerts, and Active Directory (AD) logs. The team notices that the firewall logs use a different timestamp format than the EDR and AD logs, and the AD logs do not include the user's email address, which is present in the EDR data. The team wants to enable effective correlation across these sources. What should the team do first?

   • AStore the data in its raw format and rely on the SIEM's search capabilities to find relevant events.
   • BCreate separate dashboards for each data source to avoid mixing incompatible data.
   • CIncrease the retention period for all data sources to ensure that enough data is available for correlation.
   • DNormalize the data by standardizing the timestamp format and enriching the AD logs with user email addresses from the EDR data.
   Reveal Solution Discussion Select an answer first