Incident Detection And Triage

What is the purpose of normalizing logs in a SIEM?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

When building a new SIEM use case, what is the first phase of the development lifecycle?

What is the primary function of a SIEM collector?

Which SIEM feature is used to group related events into a single incident?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Which of the following describes 'Event Correlation' in a SIEM?

What does the 'False Positive' rate of a SIEM rule indicate?

Which component of a SIEM is responsible for identifying patterns in real-time?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

What is a 'log source' in the context of a SIEM?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

During alert triage, why is it important to check the 'source' of an alert?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

Which of these is a common SIEM data ingestion protocol?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Which THREE of the following are common steps during the 'Alert Triage' process?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which THREE of the following factors should be considered when designing a new SIEM use case?

Which TWO of the following are primary components of a SIEM architecture?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Which THREE of the following are common challenges in SIEM correlation rule development?

Which THREE of the following are essential for effective incident response within a SIEM?

Which TWO of the following are standard log types ingested into a SIEM?

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

In a SIEM, what is the role of a 'Parser'?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

What is the purpose of 'Dashboards' in a SIEM?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Which TWO of the following are key components of a successful SIEM use case development process?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?