6.3 Explain the Functions of a Security Information and Event Management (SIEM) Platform CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC team wants to reduce alert fatigue by ensuring that only significant security events trigger notifications. They have a correlation rule that fires on every failed login, which is too noisy. What is the best way to refine this rule?

   • ADisable normalization for failed login logs
   • BRemove the correlation rule entirely
   • CIncrease the log collection frequency
   • DAdd a threshold, such as 10 failed logins within 5 minutes
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When a SIEM correlation rule triggers, what is the typical immediate output?

   • AAn alert sent to security analysts for review
   • BA firewall rule to block the attacker's IP
   • CA backup of all logs to an external storage
   • DA report sent to management
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company must provide auditors with evidence that their security monitoring is effective and that access to sensitive systems is reviewed regularly. Which SIEM capability would best support this requirement?

   • AReporting
   • BLog normalization
   • CCorrelation rules
   • DAlerting
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team is using a SIEM to monitor a network. They have a correlation rule that triggers an alert when a user logs in from a new geographic location. However, the rule is generating many false positives because users frequently travel. The team wants to reduce false positives while still detecting truly anomalous logins. They also need to maintain audit trails for compliance. What is the best approach?

   • AAdd a baseline of normal user locations and alert only when a login deviates significantly from the baseline
   • BGenerate a report of all user logins
   • CIncrease the alert severity to make it more noticeable
   • DDisable the rule and rely on manual review of login logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's security team is overwhelmed by the volume of raw logs from their firewalls, servers, and cloud applications. They need a way to automatically detect a multi-stage attack that spans multiple systems. Which SIEM function is most directly responsible for identifying this type of threat?

   • ALog aggregation
   • BNormalization
   • CCorrelation
   • DReporting
   Reveal Solution Discussion Select an answer first