Incident Detection And Triage

What is the purpose of normalizing logs in a SIEM?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

When building a new SIEM use case, what is the first phase of the development lifecycle?

What is the primary function of a SIEM collector?

Which SIEM feature is used to group related events into a single incident?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

Which of the following describes 'Event Correlation' in a SIEM?

What does the 'False Positive' rate of a SIEM rule indicate?

Which component of a SIEM is responsible for identifying patterns in real-time?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

What is a 'log source' in the context of a SIEM?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

Which of these is a common SIEM data ingestion protocol?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Which THREE of the following are common steps during the 'Alert Triage' process?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which THREE of the following factors should be considered when designing a new SIEM use case?

Which TWO of the following are primary components of a SIEM architecture?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Which THREE of the following are common challenges in SIEM correlation rule development?

Which THREE of the following are essential for effective incident response within a SIEM?

Which TWO of the following are standard log types ingested into a SIEM?

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

In a SIEM, what is the role of a 'Parser'?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

What is the purpose of 'Dashboards' in a SIEM?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

Which TWO of the following are key components of a successful SIEM use case development process?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?

A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)

A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?

A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?

A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?

During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?

A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)

A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?

A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?

A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?

A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?

A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)

A SOC analyst receives a QRadar offense titled 'Multiple Failed Logins Followed by Success' for a domain service account. The offense lists 42 events from a single source IP over 3 minutes. Before escalating, the analyst must perform initial triage. Which action best represents the first step of triage for this offense?

A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?

A SOC analyst in a Splunk ES environment is triaging a notable event for a possible phishing campaign. The notable event aggregates multiple email security alerts and endpoint alerts. The analyst must determine which additional data sources to correlate to confirm and scope the incident. (Choose two.)

A SOC analyst is triaging an alert from a network detection system indicating a possible internal port scan. The scan originated from a workstation and targeted multiple servers on TCP port 445. Before escalating, the analyst needs to determine whether this is malicious or benign. Which action provides the most relevant context for this decision?