312-39 Incident Detection And Triage Practice Test 3 — 15 Questions

Question 1

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Accepted Answer

Restrict the search to a specific time range and relevant indexes.. Restricting the search to a specific time range and relevant indexes is the correct optimization because SIEM queries scan indexed data, and the volume of data scanned is the primary driver of query latency. By narrowing the time window (e.g., last 24 hours instead of 30 days) and targeting only indexes that contain the relevant log sources, the SIEM engine reads far fewer events and returns results much faster. This is the standard performance-tuning technique in Splunk, Elastic, Sentinel, and QRadar.

Answer

Use wildcard searches on all fields.

Answer

Add more fields to the search result.

Answer

Increase the search timeout.

Question 2

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

Accepted Answer

Document the exception in the SIEM's rule documentation.. When a SIEM alert is confirmed as a false positive due to legitimate administrative activity, the correct action is to document the exception in the SIEM's rule documentation. This ensures that the rule is refined to reduce future false positives, and provides an audit trail for why the alert was closed without escalation. Documenting the exception helps maintain the integrity of the detection logic and supports continuous tuning of the SIEM.

Answer

Delete the user account.

Answer

Disable the user's access entirely.

Answer

Ignore the alert and proceed.

Question 3

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Accepted Answer

To reuse common logic in multiple rules.. In IBM QRadar, a Building Block is a reusable rule component that encapsulates common logic — such as a set of log sources, a filter condition, or a threshold — so it can be referenced by multiple correlation rules. This promotes consistency and reduces duplication. When the building block is updated, every rule that references it inherits the change, which is critical for maintaining large rule sets.

Answer

To delete logs from the storage.

Answer

To backup the configuration.

Answer

To generate reports automatically.

Question 4

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

Accepted Answer

Defines the time period for analyzing events.. A lookback window in a SIEM correlation rule defines how far back in time the engine examines events when evaluating the rule's conditions. It determines the time period over which related events are correlated, such as counting failed logins within the last 10 minutes. Without a lookback window, the rule would have no temporal boundary for matching events.

Answer

Selects the log source vendor.

Answer

Determines the color of the alert.

Answer

Sets the alert expiration date.

Question 5

Which of these is a common SIEM data ingestion protocol?

Accepted Answer

Syslog.. Syslog is the de facto standard protocol for transmitting event and log messages from network devices, servers, and applications to a central SIEM collector. It operates over UDP or TCP (typically port 514) and supports structured or unstructured messages, making it ideal for heterogeneous log sources. SIEM platforms natively parse syslog formats (RFC 3164 and RFC 5424) to normalize and correlate events. While HTTP can be used for some API-based ingestion, syslog remains the most common and purpose-built protocol for SIEM data collection.

Answer

ICMP.

Answer

HTTP.

Answer

DHCP.

Question 6

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

Accepted Answer

Implementing Risk-Based Alerting (RBA).. Option A, Implementing Risk-Based Alerting (RBA), is correct because RBA aggregates multiple low-severity detections into a single risk-scored entity (user, host, or IP) rather than alerting on each event individually, which dramatically reduces the volume of isolated false-positive alerts and lets analysts focus on correlated, higher-risk behavior. Option D, Setting thresholds based on baselined activity, is correct because establishing a normal behavioral baseline (for example, typical login counts, data-transfer volumes, or process execution rates per host) allows thresholds to be tuned to the environment so that only statistically anomalous deviations trigger alerts, minimizing noise from legitimate activity. Option B is wrong because disabling all alerts during off-hours creates dangerous blind spots that attackers commonly exploit and does nothing to improve alert fidelity. Option C is wrong because wildcard searches for all rules broaden matching logic, producing more spurious hits and worsening false positives rather than reducing them. Option E is wrong because increasing log retention to 10 years affects storage and forensic availability, not the precision or false-positive rate of SIEM alert rules.

Answer

Disabling all alerts during off-hours.

Answer

Using wildcard searches for all rules.

Answer

Increasing log retention to 10 years.

Question 7

Which THREE of the following are common steps during the 'Alert Triage' process?

Accepted Answer

Determining the business impact of the affected asset.. Alert triage is the process of quickly assessing and prioritizing security alerts, and it includes verifying the alert's veracity (E) to confirm whether it is a true positive or a false positive before escalating. Determining the business impact of the affected asset (A) is essential because it helps analysts prioritize alerts based on the criticality and value of the asset to the organization. Gathering context from threat intelligence (D) is also a common triage step, as it enriches the alert with information about known threat actors, indicators of compromise, and tactics, techniques, and procedures (TTPs) to better understand the threat. Rebuilding the entire network (B) and replacing all passwords in the company (C) are not triage steps; they are drastic remediation actions that would only be considered after a confirmed incident and proper analysis, not during the initial alert triage phase.

Answer

Rebuilding the entire network.

Answer

Replacing all passwords in the company.

Question 8

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Accepted Answer

In the alert's schedule or suppression settings.. Time-based conditions such as 'only trigger during business hours' are applied in the alert's schedule or suppression settings, where the SIEM evaluates the rule only within defined time windows or suppresses alerts outside them. This is a rule-level configuration that controls when the detection logic is active or when notifications fire. It is separate from data ingestion or user permissions.

Answer

In the user permission settings.

Answer

In the log ingestion configuration.

Answer

In the dashboard settings.

Question 9

Which THREE of the following factors should be considered when designing a new SIEM use case?

Accepted Answer

Data availability and quality.. Option B (Data availability and quality) is correct because a SIEM use case can only detect what the ingested telemetry supports; if the required log sources are not collected, normalized, and reliable, the correlation rule will produce false negatives or excessive false positives. Option D (Complexity of the detection logic) is correct because overly complex correlation rules are harder to tune, maintain, and troubleshoot, and they consume more SIEM processing resources, so the detection logic must be designed to balance fidelity with operational feasibility. Option E (Business risk and threat modeling) is correct because use cases should be prioritized based on the organization's critical assets, threat landscape, and MITRE ATT&CK-style adversary behaviors, ensuring detection efforts address the risks that actually matter to the business. Option A (The physical weight of the server) is not relevant because SIEM use case design concerns detection content and data sources, not hardware logistics. Option C (The color scheme of the SIEM dashboard) is not relevant because dashboard aesthetics are a presentation concern and do not affect the effectiveness or design of a detection use case.

Answer

The physical weight of the server.

Answer

The color scheme of the SIEM dashboard.

Question 10

Which TWO of the following are primary components of a SIEM architecture?

Accepted Answer

Log Collector.. In a SIEM architecture, the Log Collector (D) is a primary component because it is responsible for ingesting, normalizing, and aggregating log and event data from disparate sources such as servers, network devices, and security appliances before forwarding it for analysis. The SIEM Management/Analytics Engine (E) is also a primary component, as it correlates and analyzes the collected events, applies rules and behavioral analytics, generates alerts, and provides dashboards and reporting for security monitoring. By contrast, a Desktop Firewall (A) is an endpoint security control, an Email Gateway (B) is a mail security and filtering appliance, and a Network Router (C) is a Layer 3 forwarding device; none of these are core SIEM architectural components, even though they may generate logs that a SIEM consumes.

Answer

Desktop Firewall.

Answer

Email Gateway.

Answer

Network Router.

Question 11

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Accepted Answer

Confirmed evidence of malicious intent or unauthorized access.. Option B is correct because confirmed evidence of malicious intent or unauthorized access is a definitive trigger for escalation — once an analyst verifies true-positive malicious activity (e.g., credential compromise, data exfiltration, or active intrusion), the incident exceeds routine triage and must be handed to senior responders or incident response teams. Option D is correct because an alert involving a critical production server raises the potential business impact (downtime, data integrity, revenue loss), so it warrants escalation to prioritize containment and engage the appropriate stakeholders. Option A is not a valid reason, since an alert's name has no bearing on its severity or risk. Option C is not valid, as who generated the alert does not determine whether it requires escalation. Option E is not valid, because SIEM license expiration is an administrative/procurement concern, not an incident escalation criterion.

Answer

The user likes the alert's name.

Answer

The alert was generated by a junior analyst.

Answer

The SIEM license is expiring soon.

Question 12

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Accepted Answer

Increasing alert thresholds.. Option C (Increasing alert thresholds) is correct because raising the trigger values for rules means low-severity or borderline events no longer generate alerts, directly cutting the number of notifications analysts receive. Option E (Suppression of known-safe, noisy activity) is correct because creating suppression rules or exceptions for confirmed benign, high-frequency events (e.g., vulnerability scanners, backup jobs) prevents those events from firing alerts while preserving the underlying log data. Option A (Renaming the alert labels) only changes display text and does not reduce how many alerts are generated. Option B (Changing the password of the SIEM admin) is a security/account-management action with no effect on alert volume. Option D (Deleting all historical logs) destroys audit and forensic data and does not reduce the rate of new alerts being produced.

Answer

Renaming the alert labels.

Answer

Changing the password of the SIEM admin.

Answer

Deleting all historical logs.

Question 13

Which THREE of the following are common challenges in SIEM correlation rule development?

Accepted Answer

High rates of false positives.. Option A (High rates of false positives) is correct because correlation rules that are too broad or poorly tuned generate large volumes of benign alerts, overwhelming analysts and causing alert fatigue, which is a well-known SIEM tuning challenge. Option D (Poor log data quality) is correct because correlation depends on normalized, time-synchronized, and complete log sources; missing fields, inconsistent formats, or absent logs from key devices break rule logic and produce unreliable detections. Option E (Difficulty in finding skilled SIEM engineers) is correct because effective rule development requires expertise in query languages, log source parsing, threat detection logic, and tuning, and organizations frequently struggle to hire and retain personnel with these specialized skills. Options B (The SIEM is too colorful) and C (The SIEM is too small to fit in a rack) are not legitimate challenges in correlation rule development, as they describe superficial or physical characteristics rather than technical or operational issues affecting rule creation and accuracy.

Answer

The SIEM is too colorful.

Answer

The SIEM is too small to fit in a rack.

Question 14

Which THREE of the following are essential for effective incident response within a SIEM?

Accepted Answer

Automated playbooks or runbooks.. Automated playbooks or runbooks (A) are essential because they codify the repeatable steps analysts execute during detection, containment, eradication, and recovery, reducing mean time to respond and ensuring consistency across incidents. Clearly defined triage procedures (C) are essential because they let the SIEM team rapidly classify alerts by severity, validate true versus false positives, and prioritize which events require immediate escalation. Integration with ticketing systems (D) is essential because it creates an auditable workflow that assigns ownership, tracks status and SLAs, and preserves the evidence trail needed for post-incident review and compliance. The unmarked options do not belong: unlimited coffee (B) and a large collection of desk chairs (E) are office-comfort items with no bearing on SIEM detection, triage, or response capabilities.

Answer

Unlimited coffee supply.

Answer

A large collection of desk chairs.

Question 15

Which TWO of the following are standard log types ingested into a SIEM?

Accepted Answer

Firewall logs.. Firewall logs (B) are a standard SIEM log source because they record allowed/denied connections, source and destination IPs, ports, and protocol data (e.g., via syslog, CEF, or LEEF) that support network monitoring, correlation, and threat detection. Authentication/Login logs (E) are also standard SIEM inputs since they capture identity events such as successful and failed logons, account lockouts, and privilege changes from sources like Windows Security event logs, Linux auth.log, or RADIUS/TACACS+, which are essential for detecting brute-force and credential-based attacks. The remaining options do not belong: microwave oven event logs (A), digital clock sync logs (C), and coffee machine telemetry (D) are not conventional enterprise security log sources and are not typically ingested into a SIEM for security monitoring.

Answer

Microwave oven event logs.

Answer

Digital clock sync logs.

Answer

Coffee machine telemetry.