What is the purpose of security event correlation?

To identify patterns and incidents by combining related events

To store events in a single database

A security analyst notices a single workstation generating outbound connections to a known malicious IP address at regular 5-minute intervals. The workstation's user reports no unusual activity. What is the most appropriate next step in the anomaly analysis process?

Add the malicious IP to the blocklist and close the ticket

Immediately disconnect the workstation from the network

Dismiss the alert because the user reports no unusual activity

Conduct a deeper investigation to correlate the network connections with running processes, scheduled tasks, and recently installed software on the workstation

A healthcare organization stores patient records in a cloud database. The security team has established that normal access patterns involve an average of 500 read operations per hour from the internal network, with occasional spikes to 800 during shift changes. One morning, the database logs show 5,000 read operations from a single external IP address within 10 minutes. What should the team do first?

Ignore the event because the baseline allows for spikes up to 800 operations

Update the baseline to include the new higher volume of traffic

Treat the deviation from the established baseline as a potential security incident and initiate the investigation process

Immediately block the external IP address at the firewall

A large e-commerce company experiences significant seasonal traffic spikes during holiday sales. Their security team has a baseline for network traffic that was established during a non-holiday period. The SIEM is configured to alert on any traffic volume that exceeds 150% of this baseline. During the holiday season, the SIEM generates thousands of alerts, most of which are false positives. What is the most effective way to address this issue?

Manually review each alert to determine if it is a false positive

Establish a separate baseline for the holiday season and adjust the alert threshold accordingly

Increase the alert threshold to 300% of the original baseline

Disable the traffic volume alert rule during the holiday season

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 6)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 26–30

26foundation · easy
What is the purpose of security event correlation?
Select an answer first
27application · medium
A security analyst notices a single workstation generating outbound connections to a known malicious IP address at regular 5-minute intervals. The workstation's user reports no unusual activity. What is the most appropriate next step in the anomaly analysis process?
Select an answer first
28application · medium
A healthcare organization stores patient records in a cloud database. The security team has established that normal access patterns involve an average of 500 read operations per hour from the internal network, with occasional spikes to 800 during shift changes. One morning, the database logs show 5,000 read operations from a single external IP address within 10 minutes. What should the team do first?
Select an answer first
29expert · hard
A large e-commerce company experiences significant seasonal traffic spikes during holiday sales. Their security team has a baseline for network traffic that was established during a non-holiday period. The SIEM is configured to alert on any traffic volume that exceeds 150% of this baseline. During the holiday season, the SIEM generates thousands of alerts, most of which are false positives. What is the most effective way to address this issue?
Select an answer first
30foundation · easy
Which type of threat intelligence source is typically characterized by being freely available, often community-driven, and may include public vulnerability databases, security blogs, and open-source threat feeds?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 6)

Questions 26–30

What is the purpose of security event correlation?

A security analyst notices a single workstation generating outbound connections to a known malicious IP address at regular 5-minute intervals. The workstation's user reports no unusual activity. What is the most appropriate next step in the anomaly analysis process?

Which type of threat intelligence source is typically characterized by being freely available, often community-driven, and may include public vulnerability databases, security blogs, and open-source threat feeds?

Keep studying — Security Operations