6.3 Explain the Functions of a Security Information and Event Management (SIEM) Platform CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SIEM is receiving logs from a firewall that uses a custom log format. The security team wants to search for events where the source IP is '192.168.1.100'. However, the SIEM does not recognize the 'src_ip' field in the raw logs. What should the team do first?

   • ACreate a parsing rule to extract the source IP into a standard field
   • BGenerate a report of all firewall logs
   • CSearch the raw logs directly for the IP address
   • DEnable correlation rules for the firewall
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of a correlation rule in a SIEM?

   • AAlert when more than five failed login attempts occur from the same IP address within 10 minutes
   • BAlert when a server's CPU usage exceeds 90%
   • CAlert when a log source stops sending data
   • DAlert when a single firewall log entry shows a denied connection
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of parsing in a SIEM platform?

   • ATo extract structured fields from raw log messages
   • BTo encrypt log data in transit
   • CTo delete duplicate log entries
   • DTo compress log data to save storage space
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC team is using a SIEM to monitor a hybrid environment. They have a correlation rule that detects a brute-force attack followed by a successful login. However, the rule is also triggering on legitimate users who occasionally mistype their password. The team wants to reduce false positives while maintaining detection of actual brute-force attacks. They also need to provide monthly compliance reports. What is the best approach?

   • ADisable the correlation rule and rely on manual monitoring
   • BIncrease the alert severity to make it more noticeable
   • CAdd a threshold for the number of failed logins and exclude known legitimate IP addresses
   • DGenerate a report of all failed logins
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is required to produce a quarterly report for auditors showing all security incidents and the actions taken. The SIEM has been collecting logs and generating alerts, but the security team is manually compiling the report, which is time-consuming and prone to errors. What is the best way to streamline this process?

   • AIncrease the log retention period
   • BCreate a scheduled report that automatically compiles incident data and actions taken
   • CManually export logs to a spreadsheet
   • DDisable alerting to reduce the data volume
   Reveal Solution Discussion Select an answer first