Security Information & Event Management Flashcards

Which of the following SIEM use cases best demonstrates User and Entity Behavior Analytics (UEBA)?

Answer: Detecting a user accessing data volumes 10x above their normal pattern

UEBA profiles individual user and entity behavior and flags statistical deviations, such as anomalous data access volumes.

A SIEM operator wants to reduce storage costs while meeting a 1-year log retention compliance requirement. What is the BEST strategy?

Answer: Compress and tier old logs to lower-cost cold storage after 30–90 days

Tiered storage moves older, less-accessed logs to cheaper cold storage while keeping recent logs in fast-access hot storage.

In SIEM context, what does 'event enrichment' refer to?

Answer: Appending additional context such as geolocation or threat intelligence to raw events

Event enrichment adds contextual data—like IP reputation, geolocation, or asset criticality—to raw log events to improve analysis quality.

Which protocol is MOST commonly used to forward syslog messages to a SIEM collector?

Answer: Syslog over UDP 514 or TCP 514/6514

Syslog messages are traditionally forwarded on UDP port 514, with TCP 514 or TLS-secured 6514 used for reliable or encrypted transport.

An analyst observes that a SIEM alert for 'data exfiltration' fires every time a developer pushes code to an external Git repository. What action should the analyst take?

Answer: Tune the rule to exclude known developer IPs or the Git service destination

Rule tuning—adding exceptions for known-good traffic like authorized Git pushes—reduces false positives without eliminating legitimate detection.

What is the function of a SIEM's 'watchlist' or 'asset criticality' feature?

Answer: Prioritizing alerts involving high-value or high-risk assets or users

Asset criticality and watchlists cause the SIEM to elevate the priority of alerts involving designated high-value targets.

Which of the following best describes a 'correlation rule' in a SIEM?

Answer: A logic statement that combines multiple events or conditions to generate a higher-fidelity alert

Correlation rules define conditional logic that links multiple individual events into a composite, higher-confidence security alert.