6.3 Explain the Functions of a Security Information and Event Management (SIEM) Platform CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst notices a series of failed login attempts on a server, followed by a successful login from an unusual IP address, and then a large data transfer to an external host. The analyst wants the SIEM to automatically flag this sequence as a potential incident. What should the analyst configure?

   • AA correlation rule that triggers an alert when the sequence occurs
   • BA log source that ingests the server's authentication logs
   • CA report that summarizes failed logins and data transfers
   • DA normalization policy that standardizes the IP address fields
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's SIEM is receiving logs from multiple vendors, but the security analysts are struggling to compare events because each source uses a different timestamp format and field naming convention. Which SIEM capability would directly address this issue?

   • ANormalization
   • BLog aggregation
   • CAlerting
   • DCorrelation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's SIEM is not receiving logs from a new web application firewall (WAF). The security team has confirmed the WAF is configured to send logs, but they are not appearing in the SIEM. What is the most likely cause?

   • AThe SIEM's correlation rules are not matching the WAF logs
   • BThe WAF logs are not being normalized
   • CThe SIEM does not have a log source configured for the WAF
   • DThe WAF logs are not being reported
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's SIEM is not detecting a known attack pattern that involves multiple steps across different systems. The security team has verified that the logs are being collected and normalized correctly. What is the most likely reason the SIEM is not detecting the attack?

   • AThe alerting mechanism is disabled
   • BThe logs are not being aggregated
   • CThe correlation rule for the attack pattern is not configured or is misconfigured
   • DThe SIEM is not generating reports
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a SIEM that collects logs from multiple sources, but the security team is unable to detect an attack that occurred because the logs from a critical server were not being collected. The server's logs are in a proprietary format. The team has limited budget and time. What is the most efficient way to ensure the server's logs are collected and analyzed?

   • AUpgrade the SIEM to a more expensive version
   • BIgnore the server's logs and rely on other sources
   • CManually copy the server's logs to the SIEM daily
   • DConfigure a log source for the server and create a custom parser for its proprietary format
   Reveal Solution Discussion Select an answer first