IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

Security Information and Event Management (SIEM) MCQs (Multiple-Choice Questions)

Test your knowledge of Security Information and Event Management (SIEM) with these multiple-choice questions. This collection covers log management, security event correlation, threat detection, alert analysis, incident investigation, threat intelligence, compliance reporting, and security operations center (SOC) workflows.

Security Information and Event Management (SIEM) MCQs

Security Information and Event Management (SIEM) is a cybersecurity technology that collects and analyzes security-related data from multiple sources, including servers, endpoints, firewalls, identity systems, and cloud platforms. It centralizes log management and uses rules, correlation techniques, and analytics to identify suspicious activity and help security teams investigate potential incidents.

SIEM solutions help organizations detect threats that may be difficult to recognize by examining individual events. They also support alert prioritization, threat hunting, incident response, auditing, and compliance reporting. Understanding SIEM concepts is essential for security analysts, SOC engineers, cybersecurity students, and IT professionals.

List of Security Information and Event Management (SIEM) MCQs

The following SIEM MCQs cover fundamental concepts, log collection, normalization, event correlation, detection rules, alert management, threat intelligence, security metrics, and practical investigation scenarios. Each question includes four options, the correct answer, and an explanation to support learning and exam preparation.

1. What is the primary purpose of a Security Information and Event Management (SIEM) system?

  1. To manage employee attendance and payroll
  2. To collect, correlate, and analyze security events from multiple sources
  3. To replace all network devices
  4. To provide only file compression services

Answer: B) To collect, correlate, and analyze security events from multiple sources

Explanation:

A SIEM system centralizes security data and analyzes events from different systems to identify suspicious patterns, generate alerts, support investigations, and assist with compliance reporting.

2. Which of the following is a common source of data for a SIEM system?

  1. Firewall logs
  2. Printed office posters
  3. Furniture inventory labels
  4. Unrecorded verbal conversations

Answer: A) Firewall logs

Explanation:

Firewalls record network activity, including permitted or blocked connections and other security-relevant events. SIEM systems can combine these records with endpoint, identity, server, and application logs to identify suspicious behavior.

3. What is the difference between SIM and SEM in traditional security terminology?

  1. SIM manages network cables, while SEM manages printers
  2. SIM provides antivirus protection, while SEM provides backups
  3. SIM focuses on log storage, analysis, and reporting over time, while SEM emphasizes real-time event monitoring and correlation
  4. SIM and SEM refer exclusively to physical access control

Answer: C) SIM focuses on log storage, analysis, and reporting over time, while SEM emphasizes real-time event monitoring and correlation

Explanation:

Security Information Management (SIM) traditionally emphasizes collecting, retaining, analyzing, and reporting log data. Security Event Management (SEM) emphasizes monitoring and correlating events for timely detection. SIEM combines capabilities associated with both.

4. What is a security event in the context of SIEM?

  1. A scheduled office meeting
  2. A routine document formatting operation only
  3. A physical change to a computer desk
  4. An observable activity recorded by a system that may be relevant to security

Answer: D) An observable activity recorded by a system that may be relevant to security

Explanation:

A security event can include a successful login, a failed authentication attempt, a firewall rule change, or access to a sensitive resource. An event is not necessarily malicious; its meaning depends on context and related activity.

5. Why is log normalization important in SIEM?

  1. It converts data from different sources into a consistent structure for analysis
  2. It removes every security event from storage
  3. It ensures that all devices use identical hardware
  4. It automatically proves that every alert is malicious

Answer: A) It converts data from different sources into a consistent structure for analysis

Explanation:

Different systems record events using different formats and field names. Normalization maps these records into a common schema so analysts can compare and correlate information across sources more easily.

6. What is event correlation in a SIEM system?

  1. Deleting duplicate user accounts from an identity directory
  2. Connecting related events to identify patterns that may indicate a security incident
  3. Encrypting every stored file without analyzing it
  4. Changing the IP address of every endpoint

Answer: B) Connecting related events to identify patterns that may indicate a security incident

Explanation:

Event correlation links observations across time, devices, and accounts. For example, repeated failed logins followed by a successful login from an unusual location may indicate a compromised account and warrant investigation.

7. Which protocol is commonly used to forward log messages from network devices to a SIEM?

  1. FTP exclusively
  2. SMTP exclusively
  3. Syslog
  4. DHCP exclusively

Answer: C) Syslog

Explanation:

Syslog is widely used to transmit event messages from network devices, servers, and security appliances to centralized logging systems. Secure transport and reliable delivery options depend on the implementation and configuration.

8. What is the main purpose of a SIEM correlation rule?

  1. To assign office seating arrangements
  2. To increase storage capacity without changing infrastructure
  3. To prevent all normal user activity
  4. To detect specified combinations or sequences of events that meet defined conditions

Answer: D) To detect specified combinations or sequences of events that meet defined conditions

Explanation:

A correlation rule evaluates events against configured conditions, such as multiple failed logins followed by a successful login. When the conditions are satisfied, the SIEM may generate an alert or initiate an approved workflow.

9. What is a false positive in SIEM alerting?

  1. A legitimate activity incorrectly identified as suspicious or malicious
  2. A confirmed attack correctly detected by a rule
  3. A security event that was never generated
  4. A vulnerability that has been successfully patched

Answer: A) A legitimate activity incorrectly identified as suspicious or malicious

Explanation:

A false positive occurs when benign activity triggers an alert. For example, an authorized administrator performing an unusual but approved operation may match a detection rule. Analysts use context and tuning to reduce unnecessary alerts.

10. What is a false negative in SIEM detection?

  1. A legitimate event that triggers an unnecessary alert
  2. A genuine malicious activity that the detection system fails to identify
  3. A correctly detected and contained attack
  4. A security policy that has been reviewed

Answer: B) A genuine malicious activity that the detection system fails to identify

Explanation:

A false negative represents a missed threat. It can occur because of missing logs, weak detection rules, incomplete data sources, incorrect parsing, or attacker techniques that evade existing detection logic.

11. Why is accurate time synchronization important for SIEM analysis?

  1. It prevents all malware infections
  2. It automatically removes false positives
  3. It helps analysts reconstruct the correct sequence of events across systems
  4. It eliminates the need for event timestamps

Answer: C) It helps analysts reconstruct the correct sequence of events across systems

Explanation:

Accurate timestamps allow analysts to correlate activity from different devices and services. Clock drift, timezone differences, or inconsistent timestamp parsing can make unrelated events appear connected or obscure the real sequence of an attack.

12. What is a SIEM dashboard primarily used for?

  1. Designing physical network cables
  2. Replacing all event collection agents
  3. Creating employee vacation schedules
  4. Displaying security events, alerts, trends, and operational metrics

Answer: D) Displaying security events, alerts, trends, and operational metrics

Explanation:

SIEM dashboards present security information in a visual format. They can display alert volumes, high-priority incidents, authentication patterns, log source health, and other indicators that help analysts understand the security environment.

13. What does log retention mean?

  1. Keeping log records for a defined period according to operational, legal, or security requirements
  2. Deleting all logs immediately after collection
  3. Preventing analysts from accessing historical records
  4. Converting every log into an executable program

Answer: A) Keeping log records for a defined period according to operational, legal, or security requirements

Explanation:

Log retention defines how long records remain available for investigations, audits, threat hunting, and compliance. Organizations must balance investigative needs, regulatory obligations, storage costs, and privacy considerations.

14. What is the purpose of a SIEM data parser?

  1. To physically repair the device generating the log
  2. To extract meaningful fields from raw log messages
  3. To disable all event sources
  4. To replace every event timestamp with the current time

Answer: B) To extract meaningful fields from raw log messages

Explanation:

A parser identifies fields such as usernames, source IP addresses, event types, timestamps, and destination ports within raw messages. Correct parsing is essential for searches, correlation rules, dashboards, and reliable alert generation.

15. Which authentication pattern may indicate a password-guessing attack?

  1. A user successfully logging in once during normal business hours
  2. A scheduled password expiration notification
  3. Numerous failed login attempts against an account or multiple accounts
  4. A server completing an authorized software update

Answer: C) Numerous failed login attempts against an account or multiple accounts

Explanation:

Repeated authentication failures may indicate brute-force or password-spraying activity. Analysts should examine the number of attempts, targeted accounts, source addresses, timing, and subsequent successful logins to determine whether the pattern is malicious.

16. What is the main role of threat intelligence in a SIEM platform?

  1. To replace every internal log source
  2. To guarantee that every external IP address is malicious
  3. To manage physical office access cards exclusively
  4. To enrich events with information about known malicious indicators and threat activity

Answer: D) To enrich events with information about known malicious indicators and threat activity

Explanation:

Threat intelligence can provide context about suspicious IP addresses, domains, file hashes, and attacker behaviors. Analysts should validate this information because indicators can become outdated or may also be associated with legitimate infrastructure.

17. Which metric measures the average time required to detect a security incident?

  1. Mean Time to Detect (MTTD)
  2. Mean Time Between Failures (MTBF) exclusively
  3. Storage Utilization Percentage
  4. Network Interface Speed

Answer: A) Mean Time to Detect (MTTD)

Explanation:

MTTD measures the average time between a defined incident starting point and its detection. SIEM alerting, reliable telemetry, and well-maintained detection rules can help reduce detection delays.

18. What is the purpose of a security use case in SIEM?

  1. To define an employee's computer purchasing preferences
  2. To describe a specific threat scenario and how the SIEM should identify relevant activity
  3. To assign static IP addresses to printers
  4. To determine how office furniture is arranged

Answer: B) To describe a specific threat scenario and how the SIEM should identify relevant activity

Explanation:

A SIEM use case defines the security behavior an organization wants to detect, the required data sources, the detection logic, and the expected response. Examples include detecting suspicious privilege escalation, data exfiltration, or unauthorized account access.

19. What does a SIEM alert indicate?

  1. That a cyberattack has always been conclusively proven
  2. That every system in the organization is compromised
  3. That an event or pattern has met configured detection conditions and requires appropriate assessment
  4. That all security controls are functioning perfectly

Answer: C) That an event or pattern has met configured detection conditions and requires appropriate assessment

Explanation:

An alert identifies activity that meets a rule or analytic condition. It may represent a genuine threat, a benign event, or an inconclusive situation. Analysts review supporting evidence and context before deciding on the appropriate response.

20. Why should SIEM detection rules be tuned regularly?

  1. To ensure that every event generates an alert
  2. To prevent security analysts from investigating incidents
  3. To remove all detection logic from the platform
  4. To reduce unnecessary alerts while maintaining useful detection coverage

Answer: D) To reduce unnecessary alerts while maintaining useful detection coverage

Explanation:

Detection tuning adjusts thresholds, exclusions, conditions, and contextual logic based on observed activity. Effective tuning reduces alert fatigue without creating excessive blind spots that allow genuine attacks to go unnoticed.

21. What is a Security Operations Center (SOC)?

  1. A team or function responsible for monitoring, detecting, investigating, and responding to security incidents
  2. A device used only for printing security reports
  3. A network protocol for assigning IP addresses
  4. A database used exclusively for employee payroll

Answer: A) A team or function responsible for monitoring, detecting, investigating, and responding to security incidents

Explanation:

A SOC coordinates security monitoring and incident response. Analysts commonly use SIEM alongside endpoint detection, network monitoring, threat intelligence, and case management tools to investigate suspicious activity.

22. What is the purpose of a SIEM incident or case management feature?

  1. To automatically delete every alert after creation
  2. To organize related alerts, evidence, assignments, investigation notes, and response actions
  3. To replace all network security controls
  4. To prevent analysts from collaborating

Answer: B) To organize related alerts, evidence, assignments, investigation notes, and response actions

Explanation:

Case management helps teams track incidents from initial detection through investigation and closure. It supports accountability, collaboration, documentation, and consistent handling of security events.

23. What is a major risk of collecting logs from only a small subset of an organization's systems?

  1. Every event will automatically be duplicated
  2. The SIEM will always identify threats faster
  3. Important attack activity may remain invisible because relevant events are missing
  4. The system will no longer require detection rules

Answer: C) Important attack activity may remain invisible because relevant events are missing

Explanation:

Incomplete log coverage can prevent analysts from reconstructing an attack or correlating related events. Organizations should identify critical data sources and verify that logs are collected, parsed, retained, and monitored as intended.

24. Which log source is especially useful for investigating suspicious user authentication activity?

  1. Printer paper usage records
  2. Monitor manufacturing specifications
  3. Office temperature measurements only
  4. Identity provider and authentication logs

Answer: D) Identity provider and authentication logs

Explanation:

Identity and authentication logs can record login attempts, multifactor authentication outcomes, account lockouts, and other access-related events. Correlating these records with endpoint and network activity can help identify account compromise.

25. What is a key benefit of centralized log management?

  1. It allows analysts to search and correlate records from multiple systems in one environment
  2. It guarantees that all events are malicious
  3. It eliminates the need for secure access controls
  4. It prevents organizations from retaining historical records

Answer: A) It allows analysts to search and correlate records from multiple systems in one environment

Explanation:

Centralized logging provides a common place to search historical records and compare activity across systems. It can improve incident investigations, although the quality of analysis still depends on reliable collection, parsing, and appropriate access controls.

26. What is the purpose of role-based access control in a SIEM?

  1. To give all users unrestricted administrator access
  2. To restrict platform permissions according to assigned roles and responsibilities
  3. To prevent all authorized analysts from viewing alerts
  4. To automatically classify every event as harmless

Answer: B) To restrict platform permissions according to assigned roles and responsibilities

Explanation:

Role-based access control limits who can view sensitive logs, modify detection rules, manage integrations, or initiate response actions. It supports least privilege and reduces the risk of unauthorized changes or exposure of sensitive data.

27. What does the MITRE ATT&CK framework provide to SIEM analysts?

  1. A standard method for assigning employee salaries
  2. A protocol for transferring all log files
  3. A structured knowledge base of adversary tactics and techniques
  4. A replacement for all event collection systems

Answer: C) A structured knowledge base of adversary tactics and techniques

Explanation:

MITRE ATT&CK describes observed adversary behaviors, organized into tactics and techniques. Security teams can map SIEM detection rules to relevant techniques to assess coverage, identify gaps, and communicate detection capabilities.

28. Why is data enrichment useful in SIEM analysis?

  1. It removes the need for event timestamps
  2. It guarantees that every alert is a confirmed attack
  3. It replaces all original event records
  4. It adds contextual information, such as asset criticality, user identity, or threat intelligence

Answer: D) It adds contextual information, such as asset criticality, user identity, or threat intelligence

Explanation:

Enrichment provides additional context that helps analysts prioritize and investigate events. An alert involving a privileged account or a critical server may deserve greater attention than a similar event involving a low-risk asset.

29. Which activity is an example of threat hunting using SIEM?

  1. Searching historical logs for unusual authentication patterns that existing alerts may have missed
  2. Changing the background color of the SIEM dashboard
  3. Printing every log record without reviewing it
  4. Disabling all event collection to reduce storage usage

Answer: A) Searching historical logs for unusual authentication patterns that existing alerts may have missed

Explanation:

Threat hunting proactively searches available data for evidence of suspicious activity. Analysts may query historical authentication, endpoint, DNS, or network events to identify attack patterns that were not detected by existing rules.

30. What is a common challenge when deploying a SIEM solution?

  1. SIEM systems cannot process timestamped data
  2. Managing large volumes of logs while maintaining useful detection quality and reasonable operating costs
  3. Security events never contain structured information
  4. All log sources use exactly the same format

Answer: B) Managing large volumes of logs while maintaining useful detection quality and reasonable operating costs

Explanation:

Organizations may generate substantial amounts of log data from many systems. They must manage ingestion capacity, storage, retention, parsing, alert quality, and detection engineering without overlooking critical security information.

31. What is the purpose of a log source health monitor?

  1. To determine the physical dimensions of each server
  2. To replace the SIEM's incident response process
  3. To identify missing, delayed, or interrupted log data from connected systems
  4. To prevent all devices from generating security events

Answer: C) To identify missing, delayed, or interrupted log data from connected systems

Explanation:

A log source health monitor checks whether expected data continues to arrive. Missing logs can create detection blind spots, so monitoring ingestion delays, source connectivity, parsing failures, and event volumes is important.

32. What is the purpose of a SIEM playbook?

  1. To schedule routine office maintenance
  2. To ensure every security alert is ignored
  3. To replace event collection with manual note-taking
  4. To define repeatable investigation or response steps for a security scenario

Answer: D) To define repeatable investigation or response steps for a security scenario

Explanation:

A playbook describes how to handle a particular type of alert or incident. It may specify evidence to collect, checks to perform, escalation criteria, and response actions. Automated steps should be tested and appropriately authorized.

33. What does Mean Time to Respond (MTTR) measure in security operations?

  1. The average time taken to respond to an incident according to a defined measurement
  2. The number of log sources connected to a SIEM
  3. The total number of events collected in one day
  4. The percentage of systems running a particular operating system

Answer: A) The average time taken to respond to an incident according to a defined measurement

Explanation:

MTTR helps evaluate incident handling speed. Because organizations may measure response initiation, containment, or recovery differently, the definition should be consistent when comparing performance over time.

34. How can SIEM support regulatory compliance?

  1. By guaranteeing that an organization automatically meets every regulation
  2. By collecting relevant records and supporting audit trails, monitoring, and reporting
  3. By eliminating all requirements for access control
  4. By preventing auditors from examining security events

Answer: B) By collecting relevant records and supporting audit trails, monitoring, and reporting

Explanation:

SIEM can help organizations demonstrate monitoring activities, retain relevant records, investigate access events, and produce audit reports. A SIEM deployment alone does not guarantee compliance; appropriate policies, controls, and processes are also required.

35. What is the main difference between SIEM and Security Orchestration, Automation, and Response (SOAR)?

  1. SIEM manages physical security doors, while SOAR manages printers
  2. SIEM cannot generate alerts, while SOAR only stores logs
  3. SIEM emphasizes security data collection, analysis, and detection, while SOAR emphasizes coordinated workflows and response automation; the capabilities can overlap
  4. SIEM and SOAR are both exclusively file backup systems

Answer: C) SIEM emphasizes security data collection, analysis, and detection, while SOAR emphasizes coordinated workflows and response automation; the capabilities can overlap

Explanation:

SIEM centralizes and analyzes security events to identify potential threats. SOAR coordinates investigation and response activities across tools, often automating repetitive tasks. Many modern security platforms combine SIEM and SOAR features.

36. What is the purpose of an event severity level in SIEM?

  1. To indicate the physical size of the system generating the event
  2. To identify the event's file format only
  3. To guarantee the attacker's identity
  4. To help communicate the assessed importance or potential impact of an event

Answer: D) To help communicate the assessed importance or potential impact of an event

Explanation:

Severity levels help analysts prioritize alerts and allocate resources. A severity score may consider the detection rule, asset importance, user privileges, threat intelligence, and other context. Severity is not automatically proof that an attack succeeded.

37. Why should analysts investigate a successful login that follows many failed attempts?

  1. It may indicate that a password-guessing attempt eventually succeeded
  2. It proves that the account owner has changed computers
  3. It guarantees that the authentication system is malfunctioning
  4. It always indicates a normal password reset

Answer: A) It may indicate that a password-guessing attempt eventually succeeded

Explanation:

A sequence of failed attempts followed by a successful login can indicate a compromised account. Analysts should examine the source address, targeted account, timing, device context, multifactor authentication results, and subsequent activity.

38. What is data exfiltration in cybersecurity?

  1. Installing an approved software update
  2. Unauthorized transfer of data out of a system or organization
  3. Creating a routine backup according to policy
  4. Normalizing log field names

Answer: B) Unauthorized transfer of data out of a system or organization

Explanation:

Data exfiltration occurs when information is transferred outside an authorized boundary without permission. SIEM can help identify suspicious outbound traffic, unusual data transfer volumes, unexpected destinations, and access patterns associated with sensitive resources.

39. Which log source can help identify suspicious DNS activity?

  1. Office cafeteria menus
  2. Printer toner replacement records
  3. DNS resolver or DNS security logs
  4. Employee desk allocation spreadsheets only

Answer: C) DNS resolver or DNS security logs

Explanation:

DNS logs can record domain queries, response information, and related timestamps. Unusual query patterns, suspicious domains, or unexpectedly high volumes of requests may help identify malware communication, domain generation activity, or other threats.

40. What is a major benefit of integrating SIEM with an endpoint detection platform?

  1. It eliminates the need to investigate security alerts
  2. It guarantees that every endpoint event is malicious
  3. It prevents endpoints from generating logs
  4. It allows endpoint alerts and activity to be correlated with identity, network, and other security events

Answer: D) It allows endpoint alerts and activity to be correlated with identity, network, and other security events

Explanation:

Integrating endpoint security data with SIEM provides a broader view of an incident. Analysts can correlate process activity with authentication events, network connections, and other records to investigate the attack's scope and sequence.

41. What should an organization consider when choosing a SIEM log retention period?

  1. Security investigation needs, applicable regulations, privacy obligations, and storage costs
  2. Only the color of the dashboard
  3. The number of employees who prefer paper reports
  4. Whether the log file names are short

Answer: A) Security investigation needs, applicable regulations, privacy obligations, and storage costs

Explanation:

Retention requirements vary according to the organization, data type, threat model, and applicable laws. A suitable policy balances historical investigation needs with storage costs, access restrictions, and limits on retaining sensitive information.

42. What is alert fatigue in a Security Operations Center?

  1. A hardware failure caused by excessive event timestamps
  2. A condition in which a high volume of alerts makes it harder for analysts to recognize and prioritize genuine threats
  3. A technique for increasing network bandwidth
  4. A method for encrypting SIEM dashboards

Answer: B) A condition in which a high volume of alerts makes it harder for analysts to recognize and prioritize genuine threats

Explanation:

Excessive low-value alerts can overwhelm analysts and delay investigation of serious incidents. Rule tuning, event deduplication, contextual enrichment, risk-based prioritization, and appropriate automation can help reduce alert fatigue.

43. Why should SIEM administrators protect the integrity of collected logs?

  1. To ensure that every log record is converted into an image
  2. To prevent analysts from searching historical records
  3. To reduce the risk of unauthorized alteration or deletion that could undermine investigations and audits
  4. To make every security event appear equally severe

Answer: C) To reduce the risk of unauthorized alteration or deletion that could undermine investigations and audits

Explanation:

Logs may be important evidence during investigations and compliance reviews. Access restrictions, audit trails, secure storage, integrity verification, and suitable retention controls help protect records from unauthorized changes.

44. What is a UEBA capability often used alongside SIEM?

  1. Universal Endpoint Backup Administration
  2. User Event Binary Allocation
  3. Unified Email Backup Architecture
  4. User and Entity Behavior Analytics

Answer: D) User and Entity Behavior Analytics

Explanation:

UEBA analyzes behavior associated with users, devices, and other entities to identify deviations from expected patterns. It can help detect unusual access, potential account compromise, or suspicious activity that may not match a simple fixed rule.

45. Which practice helps protect a SIEM system against unauthorized administrative changes?

  1. Using multifactor authentication, least-privilege permissions, and administrative audit logging
  2. Sharing one administrator password with all employees
  3. Disabling authentication for the management console
  4. Allowing every user to modify detection rules

Answer: A) Using multifactor authentication, least-privilege permissions, and administrative audit logging

Explanation:

A SIEM platform contains sensitive security information and detection logic. Strong authentication, restricted administrative access, monitoring of configuration changes, and regular reviews help protect the platform from misuse.

46. What is the purpose of a baseline in SIEM behavioral analysis?

  1. To ensure that all users perform identical activities
  2. To establish an expected pattern of activity against which deviations can be assessed
  3. To prevent the collection of historical events
  4. To guarantee that unusual activity is always malicious

Answer: B) To establish an expected pattern of activity against which deviations can be assessed

Explanation:

A baseline represents typical activity for a user, system, or environment. Deviations may indicate a threat, but legitimate changes such as new work schedules or software deployments can also produce unusual patterns and require contextual assessment.

47. Why should organizations test SIEM detection rules after making changes?

  1. To ensure that no events can trigger alerts
  2. To increase the number of unrelated alerts
  3. To verify that the rules detect intended scenarios without creating unacceptable false positives or breaking existing detections
  4. To remove the need for log source monitoring

Answer: C) To verify that the rules detect intended scenarios without creating unacceptable false positives or breaking existing detections

Explanation:

Detection testing helps confirm that rule conditions work as intended. Controlled simulations, representative event data, and regression tests can reveal missing fields, incorrect thresholds, and unexpected side effects before changes are deployed widely.

48. What does a SIEM risk-based alerting approach attempt to achieve?

  1. To give every event the same priority regardless of context
  2. To ignore alerts from critical systems
  3. To classify every login as a confirmed attack
  4. To prioritize activity using combined risk signals and contextual information

Answer: D) To prioritize activity using combined risk signals and contextual information

Explanation:

Risk-based alerting combines signals such as unusual authentication, privileged access, asset importance, and suspicious network behavior. This approach can help analysts focus on the combinations of events that present the greatest potential risk.

49. Which sequence best describes a typical SIEM-driven incident investigation?

  1. Ignore the alert, delete the logs, and close the case
  2. Detect suspicious activity, examine supporting events, assess scope and impact, coordinate response, and document the outcome
  3. Disable all security controls before checking the evidence
  4. Restore affected systems before determining whether a threat exists

Answer: B) Detect suspicious activity, examine supporting events, assess scope and impact, coordinate response, and document the outcome

Explanation:

A structured investigation validates the alert, collects supporting evidence, determines affected accounts and systems, and guides containment and remediation. Documenting the outcome helps improve detection rules and future incident handling.

50. A SIEM monitors authentication logs from an organization's identity provider. Within five minutes, an account records 18 failed login attempts from an unfamiliar IP address, followed by a successful login. The same account then accesses a sensitive server it has not accessed before. What is the most appropriate action for the SOC analyst?

  1. Close the alert because a successful login proves the user is legitimate
  2. Delete the authentication logs to prevent duplicate alerts
  3. Correlate the authentication and server-access events, investigate the source and account context, assess possible compromise, and initiate authorized containment if warranted
  4. Disable SIEM collection for the identity provider

Answer: C) Correlate the authentication and server-access events, investigate the source and account context, assess possible compromise, and initiate authorized containment if warranted

Explanation:

The sequence of repeated failures, an unfamiliar source, a successful login, and unusual access to a sensitive server may indicate a compromised account. The analyst should correlate the events, review authentication context and account privileges, check for additional suspicious activity, and follow the incident response process. Depending on the evidence and risk, actions may include revoking sessions, resetting credentials, enforcing additional authentication, or restricting the account. A successful login alone does not establish that access was legitimate.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.