GSEC Log Management and SIEM — 15 Questions

Question 1

A security analyst is tasked with creating a SIEM correlation rule to detect potential credential stuffing attacks against an enterprise web application. Which behavioral pattern provides the most reliable indicator for this specific threat vector while minimizing false positives from legitimate users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A high volume of failed authentication events originating from a distributed botnet where each source IP attempts a single login across many different user accounts.. Credential stuffing involves automated submission of stolen credentials across many accounts from distinct IP addresses or coordinated botnets. Correlating high volumes of failed login attempts paired with a high diversity of targeted usernames from a unified source profile effectively isolates malicious automation from isolated user errors.

Answer

Multiple failed authentication attempts originating from a single IP address targeting the same administrative account.

Answer

A successful authentication event immediately followed by an administrative permission escalation within the same session.

Answer

Frequent password reset requests submitted by external IP addresses during non-business operating hours.

Question 2

Refer to the exhibit. An analyst reviews the parsed Windows security event JSON payload forwarded to the SIEM. Based on the event attributes, what specific activity does this log entry represent?

Accepted Answer

A successful network logon session established across the local area network using the NTLM authentication protocol.. Windows Event ID 4624 with Logon Type 3 indicates a successful network logon, such as accessing a shared folder or authentication via NTLM across the network. Recognizing specific Windows logon types is crucial for identifying unauthorized remote access and lateral movement patterns in enterprise environments.

Answer

An interactive local login where the user authenticated directly at the physical console keyboard and mouse.

Answer

A remote desktop session connection authenticated via Network Level Authentication and Remote Desktop Protocol.

Answer

A background service startup execution authenticated under the local system service account context.

Question 3

Refer to the exhibit. An auditor reviews the Linux authentication logs for suspicious administrative activity. What security concern is highlighted by the chronological sequence of these two log entries?

Accepted Answer

A direct administrative login occurred as the root user, violating best practices that require non-repudiation via named accounts.. The first log shows a direct SSH root login using public key authentication, followed immediately by a standard user escalating privileges via sudo. Direct root logins over SSH violate security best practices, as administrative access should occur via named user accounts followed by privilege escalation for accountability.

Answer

A brute-force password guessing attack was successfully executed against the root user account.

Answer

An unauthorized privilege escalation attempt failed because the user jsmith lacked sudo permissions.

Answer

The SSH daemon experienced a critical configuration failure and dropped incoming connection requests.

Question 4

A security team needs to ensure log integrity for compliance purposes. Which log management practice provides the strongest assurance that log data has not been tampered with after ingestion?

Accepted Answer

Configuring log rotation to overwrite the oldest log files every twenty-four hours.. Ensuring log integrity is a fundamental requirement for forensic investigations and regulatory compliance frameworks like PCI DSS or HIPAA. By using cryptographic techniques like hashing and digital signatures, organizations can verify that logs remain in their original state. This capability is vital because attackers often attempt to modify or delete logs to hide their activities once they have gained administrative access to a compromised system.

Answer

Regularly clearing the event logs to free up storage space for new logs.

Answer

Storing all log files in a shared network folder with everyone having read access.

Answer

Using a simple text file format for all logs to ensure maximum compatibility.

Question 5

Which TWO of the following are primary benefits of implementing a centralized log management (CLM) architecture? (Choose two)

Accepted Answer

Improved ability to perform correlation across different device types.. Centralized log management is a cornerstone of modern security operations, enabling efficient threat detection, forensic analysis, and regulatory compliance. By consolidating logs from disparate sources, organizations gain a unified view of their security posture. This consolidation is critical for long-term data retention and cross-platform correlation, which would be impossible if logs remained isolated on individual hosts, hidden from the view of the central security team.

Answer

Increased local disk space availability on individual workstations.

Answer

Elimination of the need for an enterprise firewall.

Answer

Automatic removal of all malicious actors from the network.

Question 6

A security operations center (SOC) receives a SIEM alert for a suspected data exfiltration. The analyst wants to correlate outbound network flows with the associated endpoint process information to determine which application initiated the transfer. The environment collects logs from a Zeek network sensor and Windows Sysmon. Which log source and field combination should the analyst use to correlate the flow to the process?

Accepted Answer

Zeek conn.log (id.orig_h, id.resp_h, id.resp_p) joined with Sysmon Event ID 3 (DestinationIp, DestinationPort) on matching 5-tuple.. The analyst needs to map a network flow to the originating process. Sysmon Event ID 3 provides the process context (ProcessGuid, Image) along with the network 5-tuple. Zeek conn.log provides the same 5-tuple. Joining on the 5-tuple allows the SIEM to enrich the network flow with process details, enabling accurate attribution. Other options lack a reliable common field or the necessary process information.

Answer

Windows Security Event ID 5156 joined with Zeek conn.log on the process ID (PID).

Answer

Zeek conn.log (uid) joined with Sysmon Event ID 3 (ProcessGuid) on matching timestamps.

Answer

Zeek http.log (host, uri) joined with Sysmon Event ID 22 (QueryName) on matching domain names.

Question 7

A security team is designing a SIEM correlation rule to detect potential lateral movement using Windows Remote Desktop Protocol (RDP). They want to alert when a user account successfully authenticates to multiple distinct hosts via RDP within a short time window. Which TWO log sources and events should be used to build this correlation? (Choose two.)

Accepted Answer

Windows Security Event ID 1149 (Remote Desktop Services: User authentication succeeded).. To detect RDP lateral movement, the SIEM should monitor successful RDP authentications across multiple hosts. Event ID 4624 with LogonType 10 provides the username and destination host, while Event ID 1149 provides the username and source IP for RDP sessions. Together, they allow correlation of a single account authenticating to multiple systems within a short window. Failed logons (4625) and generic credential events (4776, 4648) are less specific and would introduce noise.

Answer

Windows Security Event ID 4648 (A logon was attempted using explicit credentials).

Answer

Windows Security Event ID 4625 with LogonType 10.

Answer

Windows Security Event ID 4776 (The domain controller attempted to validate the credentials for an account).

Question 8

An analyst notices that the SIEM is triggering an excessive number of 'False Positive' alerts related to failed login attempts. Which strategy is most effective for reducing these alerts without compromising security posture?

Accepted Answer

Implement a threshold-based correlation rule to alert only after five failed attempts within one minute.. Tuning the SIEM to filter noise is critical for preventing analyst fatigue and ensuring high-fidelity alerts remain visible. By creating suppression rules for known service account behavior or implementing threshold-based alerts, analysts can focus on genuine threats. This process is essential for maintaining a healthy SIEM environment where security teams can respond efficiently to legitimate incidents rather than chasing benign log noise generated by standard system maintenance tasks.

Answer

Disable all failed login logging on domain controllers to save SIEM storage.

Answer

Increase the severity level of all login failure logs to 'Critical'.

Answer

Archive all failed login logs to cold storage immediately upon ingestion.

Question 9

Refer to the exhibit. An analyst observes the provided log output. What is the most likely security incident occurring, and what is the best immediate action?

Accepted Answer

Brute-force attack; investigate the source IP and block it if unauthorized.. The exhibit shows a rapid sequence of failed login attempts from a single internal IP address, which is indicative of a brute-force or credential-stuffing attack. Security professionals must identify this pattern quickly to prevent account compromise. The standard response involves investigating the source IP for malicious intent and blocking the traffic at the network perimeter or host level to mitigate the risk of unauthorized access to the server.

Answer

Hardware failure; replace the server network interface card immediately.

Answer

Network congestion; increase the logging frequency of the server.

Answer

User error; reset the user's password to clear the event logs.

Question 10

Which THREE of the following represent critical log sources that should be ingested into a SIEM for effective network-wide security visibility? (Choose three)

Accepted Answer

Firewall logs. Effective SIEM visibility requires a diverse set of data sources to correlate activities across the infrastructure. Combining endpoint, network, and identity logs allows for comprehensive monitoring. These sources provide the raw telemetry necessary for detecting lateral movement, command-and-control communication, and unauthorized privilege escalation. Without this breadth of information, security teams are likely to miss the early indicators of a sophisticated attack transitioning through different segments of the enterprise network.

Answer

Local printer spooler temporary files

Answer

Office document metadata templates

Question 11

A security analyst is tuning the SIEM to reduce noise. The current rule fires whenever a Windows event with ID 4625 (failed logon) occurs. Which modification should the analyst make to the rule to better identify a brute-force attack while reducing false positives?

Accepted Answer

Change the rule to trigger only when the same source IP generates more than 10 failed logons within 5 minutes.. Brute-force attacks are characterized by a high volume of failed authentication attempts from a single source in a short period. A threshold-based correlation rule that counts failures per source IP within a time window effectively separates automated attacks from occasional user mistypes, reducing false positives while maintaining detection fidelity.

Answer

Set the rule to alert only when event ID 4625 occurs outside of business hours.

Answer

Add a filter to exclude all failed logon events from privileged accounts.

Answer

Configure the rule to trigger only when event ID 4625 is followed by event ID 4624 (successful logon) from the same user within 1 minute.

Question 12

A security operations center (SOC) ingests NetFlow records into its SIEM. An analyst wants to detect potential data exfiltration over the network. Which SIEM correlation strategy is most effective for this purpose?

Accepted Answer

Correlate outbound traffic volume with destination IP reputation and unusual port usage, and alert on deviations from the host's historical baseline.. Data exfiltration detection benefits from behavioral baselining and multi-factor correlation. By learning each host's normal outbound traffic patterns and combining volume anomalies with destination reputation and port usage, the SIEM can flag suspicious transfers that would be missed by static thresholds or country blocks alone.

Answer

Alert when any host initiates a connection to a country that is not on an approved list.

Answer

Alert when any internal host sends more than 1 GB of data to an external IP address within an hour.

Answer

Monitor for DNS queries to known command-and-control domains and alert on any match.

Question 13

A security analyst is tuning a Splunk Enterprise correlation search that detects brute-force attempts against SSH. The current search fires thousands of alerts daily because it counts every failed password event, including those from a single user who mistypes a password once. The analyst needs to reduce noise while still catching distributed brute-force attacks. Which modification should the analyst make to the correlation search?

Accepted Answer

Correlate failed logins across multiple source IPs by counting distinct source IPs per target account over a longer window, and trigger when the distinct count exceeds a threshold.. Distributed brute-force attacks spread login attempts across many source IPs to evade per-IP thresholds. The effective detection method is to correlate failed logins by target account and count distinct source IPs over a longer period. This catches the attack while ignoring a single user's occasional mistyped password, reducing false positives without missing the distributed pattern.

Answer

Add a threshold condition that triggers only when more than 10 failed logins occur from the same source IP within 5 minutes.

Answer

Increase the search time window to 24 hours and lower the alert threshold to 5 failed logins per user.

Answer

Filter out all failed password events for service accounts and only alert on failed logins for interactive user accounts.

Question 14

A security operations center (SOC) uses a SIEM to collect logs from various sources. The SOC manager wants to ensure that log data is retained for at least one year to meet regulatory requirements, but the SIEM's primary storage is expensive and limited. Which log management strategy should the SOC implement to meet the retention requirement cost-effectively?

Accepted Answer

Configure the SIEM to compress and archive older logs to a secondary storage tier, such as a network-attached storage (NAS) or cloud object storage, after a defined period.. The most cost-effective way to meet long-term retention is to tier storage: keep recent logs on fast, expensive primary storage and archive older logs to cheaper secondary storage. This balances performance for active investigations with compliance retention, avoiding unnecessary primary storage expansion or risky reliance on source systems.

Answer

Reduce the log retention period to 30 days and rely on the original log sources to retain their own logs for one year.

Answer

Increase the SIEM's primary storage capacity by adding more high-performance disks to accommodate one year of logs.

Answer

Disable logging for low-priority sources and keep only high-priority logs for one year on primary storage.

Question 15

A SIEM administrator is troubleshooting why Windows event logs forwarded from a domain controller are not being parsed correctly. The logs are sent using the Windows Event Forwarding (WEF) subscription, but the SIEM shows raw XML instead of normalized fields. The administrator confirms that the WEF subscription is active and events are arriving. Which action should the administrator take to ensure proper parsing?

Accepted Answer

Create a custom parser in the SIEM that extracts fields from the XML structure of the WEF events.. WEF forwards events in XML format. If the SIEM's collector is not configured to parse that XML, it stores raw XML and fields are not normalized. The administrator should create a custom parser that extracts relevant fields from the WEF XML schema and maps them to the SIEM's data model. Other options either do not address the parsing issue or are technically infeasible.

Answer

Install a SIEM agent on the domain controller to read the event logs directly and forward them in a normalized format.

Answer

Configure the SIEM to use the Windows Event Log collector with the correct channel names and enable XML parsing.

Answer

Modify the WEF subscription to forward events in JSON format instead of XML.