Incident Detection And Triage

In a SIEM, what is the role of a 'Parser'?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?

A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Which component of a SIEM is responsible for identifying patterns in real-time?

Which THREE of the following factors should be considered when designing a new SIEM use case?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

What is a 'log source' in the context of a SIEM?

What does the 'False Positive' rate of a SIEM rule indicate?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?

A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

What is the purpose of 'Dashboards' in a SIEM?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Which THREE of the following are essential for effective incident response within a SIEM?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Which THREE of the following are common steps during the 'Alert Triage' process?

Which of these is a common SIEM data ingestion protocol?

A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Which TWO of the following are standard log types ingested into a SIEM?

When building a new SIEM use case, what is the first phase of the development lifecycle?

A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?

Which TWO of the following are key components of a successful SIEM use case development process?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Which TWO of the following are primary components of a SIEM architecture?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

What is the purpose of normalizing logs in a SIEM?

A SOC analyst in a Splunk ES environment is triaging a notable event for a possible phishing campaign. The notable event aggregates multiple email security alerts and endpoint alerts. The analyst must determine which additional data sources to correlate to confirm and scope the incident. (Choose two.)

A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Which of the following describes 'Event Correlation' in a SIEM?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which THREE of the following are common challenges in SIEM correlation rule development?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Which SIEM feature is used to group related events into a single incident?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

A SOC analyst receives a QRadar offense titled 'Multiple Failed Logins Followed by Success' for a domain service account. The offense lists 42 events from a single source IP over 3 minutes. Before escalating, the analyst must perform initial triage. Which action best represents the first step of triage for this offense?

What is the primary function of a SIEM collector?

A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

A SOC analyst is triaging an alert from a network detection system indicating a possible internal port scan. The scan originated from a workstation and targeted multiple servers on TCP port 445. Before escalating, the analyst needs to determine whether this is malicious or benign. Which action provides the most relevant context for this decision?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?