A threat hunter is investigating a hypothesis that an attacker is using a legitimate remote administration tool to move laterally within the network. Which of the following data sources would be most valuable to confirm or refute this hypothesis?

Netflow data showing the volume of traffic between hosts.

DNS logs showing queries to external domains.

Firewall logs showing all inbound and outbound connections.

Endpoint logs showing the execution of remote administration tools and the associated processes.

A healthcare organization is deploying a SIEM to meet compliance requirements and improve incident detection. The security team has connected the SIEM to the firewall, Active Directory, and antivirus logs. The compliance officer requires evidence that all user authentication events are being captured. What is the most important additional step to ensure the SIEM provides this evidence?

Create a correlation rule that alerts when authentication failures exceed a threshold.

Increase the log retention period for authentication events to one year.

Configure the SIEM to generate a daily report of all authentication events for the compliance officer.

Verify that the SIEM is receiving logs from all domain controllers and that the log sources are healthy.

What is the primary purpose of the correlation engine in a SIEM?

To store logs for long-term retention

To collect logs from multiple sources

To provide a graphical interface for security analysts

To analyze aggregated data and identify relationships between events

Certified Information Systems Security Professional

Domain 7Objective 2

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 8)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

13%of the exam

Questions 36–40

36application · medium
A threat hunter is investigating a hypothesis that an attacker is using a legitimate remote administration tool to move laterally within the network. Which of the following data sources would be most valuable to confirm or refute this hypothesis?
Select an answer first
37application · medium
A healthcare organization is deploying a SIEM to meet compliance requirements and improve incident detection. The security team has connected the SIEM to the firewall, Active Directory, and antivirus logs. The compliance officer requires evidence that all user authentication events are being captured. What is the most important additional step to ensure the SIEM provides this evidence?
Select an answer first
38foundation · easy
Which component of a SIEM system is responsible for collecting log data from various sources and normalizing it into a common format?
Select an answer first
39foundation · easy
What is the primary purpose of the correlation engine in a SIEM?
Select an answer first
40foundation · easy
Which evasion technique involves breaking a malicious payload into smaller pieces to avoid detection by an IDPS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 8)

Questions 36–40

A threat hunter is investigating a hypothesis that an attacker is using a legitimate remote administration tool to move laterally within the network. Which of the following data sources would be most valuable to confirm or refute this hypothesis?

Which component of a SIEM system is responsible for collecting log data from various sources and normalizing it into a common format?

What is the primary purpose of the correlation engine in a SIEM?

Which evasion technique involves breaking a malicious payload into smaller pieces to avoid detection by an IDPS?

Keep studying — Security Operations