312-39 Incident Detection And Triage Practice Test 3 — 15 Questions

Question 1

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. Building blocks allow you to reuse common logic (e.g., 'Internal IPs') across multiple rules.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 2

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

Accepted Answer

Defines the time period for analyzing events.. The lookback window defines the timeframe for analyzing historical events to detect a pattern.

Answer

Selects the log source vendor.

Answer

Determines the color of the alert.

Answer

Sets the alert expiration date.

Question 3

Which of these is a common SIEM data ingestion protocol?

Accepted Answer

Syslog.. Syslog is the most common and standard protocol for log transmission.

Answer

ICMP.

Answer

HTTP.

Answer

DHCP.

Question 4

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Tuning thresholds and using risk-based alerting are key strategies.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 5

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Triage involves verification, context gathering, and determining impact.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 6

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based scheduling is a core feature for managing alert relevance in SIEMs.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 7

Which THREE of the following factors should be considered when designing a new SIEM use case?

Accepted Answer

Data availability and quality.. Data availability, business risk, and rule complexity are essential considerations.

Answer

The physical weight of the server.

Answer

The color scheme of the SIEM dashboard.

Question 8

Which TWO of the following are primary components of a SIEM architecture?

Accepted Answer

Log Collector.. Collectors and the central analytics engine are core components.

Answer

Desktop Firewall.

Answer

Email Gateway.

Answer

Network Router.

Question 9

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Accepted Answer

Confirmed evidence of malicious intent or unauthorized access.. High-impact assets and confirmed malicious activity are primary escalation criteria.

Answer

The user likes the alert's name.

Answer

The alert was generated by a junior analyst.

Answer

The SIEM license is expiring soon.

Question 10

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Accepted Answer

Increasing alert thresholds.. Suppression and threshold tuning are primary reduction methods.

Answer

Renaming the alert labels.

Answer

Changing the password of the SIEM admin.

Answer

Deleting all historical logs.

Question 11

Which THREE of the following are common challenges in SIEM correlation rule development?

Accepted Answer

High rates of false positives.. Noise, data quality, and skill requirements are major challenges.

Answer

The SIEM is too colorful.

Answer

The SIEM is too small to fit in a rack.

Question 12

Which THREE of the following are essential for effective incident response within a SIEM?

Accepted Answer

Automated playbooks or runbooks.. Documentation, playbooks, and integration are critical for response.

Answer

Unlimited coffee supply.

Answer

A large collection of desk chairs.

Question 13

Which TWO of the following are standard log types ingested into a SIEM?

Accepted Answer

Firewall logs.. Firewall and Authentication logs are fundamental security data.

Answer

Microwave oven event logs.

Answer

Digital clock sync logs.

Answer

Coffee machine telemetry.

Question 14

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Accepted Answer

User identity and department information.. Asset info, threat intel, and user identity add meaning to raw logs.

Answer

The weather in the data center.

Answer

The lunch menu of the security team.

Question 15

In a SIEM, what is the role of a 'Parser'?

Accepted Answer

To extract fields and normalize log data.. Parsers normalize raw log data into a structured format with defined fields.

Answer

To print reports.

Answer

To encrypt log files.

Answer

To scan for viruses.