Incident Detection And Triage

In a SIEM, what is the role of a 'Parser'?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

Which component of a SIEM is responsible for identifying patterns in real-time?

Which THREE of the following factors should be considered when designing a new SIEM use case?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

What is a 'log source' in the context of a SIEM?

What does the 'False Positive' rate of a SIEM rule indicate?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

What is the purpose of 'Dashboards' in a SIEM?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

Which THREE of the following are essential for effective incident response within a SIEM?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

Which THREE of the following are common steps during the 'Alert Triage' process?

Which of these is a common SIEM data ingestion protocol?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

Which TWO of the following are standard log types ingested into a SIEM?

When building a new SIEM use case, what is the first phase of the development lifecycle?

During alert triage, why is it important to check the 'source' of an alert?

Which TWO of the following are key components of a successful SIEM use case development process?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Which TWO of the following are primary components of a SIEM architecture?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

What is the purpose of normalizing logs in a SIEM?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

Which of the following describes 'Event Correlation' in a SIEM?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

Which THREE of the following are common challenges in SIEM correlation rule development?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

Which SIEM feature is used to group related events into a single incident?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

What is the primary function of a SIEM collector?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?