6.3 Explain the Functions of a Security Information and Event Management (SIEM) Platform CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What type of SIEM report would be most useful for tracking security incidents over a specific period?

   • AA summary report showing the number and types of alerts generated
   • BA report of firewall configuration changes
   • CA report of all user login attempts
   • DA real-time dashboard showing current network traffic
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security analyst needs to identify which SIEM function turns raw log entries into a consistent format so that events from different systems can be compared. Which function is this?

   • AAlerting
   • BCorrelation
   • CReporting
   • DNormalization
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why do SIEM platforms normalize log data into a common format?

   • ATo reduce the size of log files for efficient storage
   • BTo allow logs from different sources to be compared and correlated consistently
   • CTo make logs unreadable to unauthorized users
   • DTo ensure logs are sent to the correct destination
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company must demonstrate to a regulator that they have been monitoring user access to a critical database for the past year. What is the most appropriate SIEM feature to use?

   • ASet up an alert for database access
   • BConfigure a new log source for the database
   • CCreate a new correlation rule for database access
   • DGenerate a report showing access events over the past 12 months
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is investigating a potential data exfiltration incident. The SIEM has detected a large outbound data transfer from a server to an external IP address. The team wants to determine if this is part of a larger attack pattern. What is the most effective use of the SIEM?

   • AGenerate a report of all outbound data transfers
   • BCorrelate the data transfer with other events, such as unusual logins or malware detections, across multiple sources
   • CDisable the alert for large data transfers
   • DIncrease the log collection frequency for the server
   Reveal Solution Discussion Select an answer first