6.3 Explain the Functions of a Security Information and Event Management (SIEM) Platform CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common use of SIEM reporting?

   • AEncrypting log data at rest
   • BReplacing the need for external audits
   • CDemonstrating compliance with regulatory requirements such as PCI DSS or GDPR
   • DAutomatically blocking malicious IP addresses
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How do SIEM platforms support incident response workflows?

   • ABy isolating infected devices from the network without human intervention
   • BBy providing a centralized view of alerts and associated log data for investigation
   • CBy replacing the need for a security operations center (SOC)
   • DBy automatically patching vulnerabilities on affected systems
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of correlation in a SIEM platform?

   • ATo store logs in a centralized repository for long-term retention
   • BTo remove false positives from alert logs
   • CTo generate compliance reports for auditors
   • DTo identify relationships between events from different sources to detect potential security incidents
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A financial company's SIEM is generating a high volume of alerts, most of which are false positives. The security team is spending too much time triaging alerts and missing real incidents. They want to improve the signal-to-noise ratio without losing critical detections. They also need to maintain compliance reporting. What is the best approach?

   • ARefine correlation rules with thresholds and exceptions, and tune alerting to reduce noise
   • BDisable all correlation rules and rely on manual log review
   • CIncrease the log collection frequency to get more data
   • DGenerate more detailed reports for compliance
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A SIEM platform needs to collect logs from a cloud-based application that does not support syslog. Which of the following is a common method to collect logs from such an application?

   • AUsing a packet capture tool to intercept HTTP traffic
   • BInstalling a network tap on the application's server
   • CUsing an API provided by the application
   • DConfiguring the application to send SNMP traps
   Reveal Solution Discussion Select an answer first