CCD Security Information & Event Management 2 — Questions and Answers
Question 1: Which SIEM component is responsible for normalizing log data from heterogeneous sources into a common format?
- Event correlation engine
- Log normalization parser (Correct answer)
- Threat intelligence feed
- Asset discovery module
Correct answer: Log normalization parser
The log normalization parser transforms raw log data from diverse sources into a consistent, structured format for analysis.
Question 2: A SIEM generates an alert every time a user logs in outside business hours. After a week, analysts begin ignoring these alerts. This is an example of:
- Alert fatigue caused by excessive false positives (Correct answer)
- A tuned baseline detection rule
- Proper use of behavioral analytics
- An effective incident response workflow
Correct answer: Alert fatigue caused by excessive false positives
Alert fatigue occurs when too many low-fidelity or false-positive alerts cause analysts to desensitize and miss real threats.
Question 3: What is the primary purpose of baselining in a SIEM environment?
- To set log retention policies
- To establish normal behavior so anomalies can be detected (Correct answer)
- To configure firewall rules automatically
- To archive raw logs to cold storage
Correct answer: To establish normal behavior so anomalies can be detected
Baselining establishes what 'normal' activity looks like so that deviations—potential threats—trigger meaningful alerts.
Question 4: Which log source would be MOST valuable in a SIEM for detecting lateral movement within a network?
- Web application firewall logs
- Windows Security Event Logs (authentication/logon events) (Correct answer)
- DNS query logs from external resolvers
- Antivirus definition update logs
Correct answer: Windows Security Event Logs (authentication/logon events)
Windows Security Event Logs capture authentication and logon events that reveal account usage patterns indicative of lateral movement.
Question 5: An analyst notices that SIEM correlation rules are triggering alerts based on mismatched timestamps between sources. What is the BEST remediation?
- Disable timestamp-based rules
- Implement NTP synchronization across all log sources (Correct answer)
- Increase the alert threshold window
- Switch to a syslog-only collection model
Correct answer: Implement NTP synchronization across all log sources
NTP synchronization ensures all devices report consistent timestamps, enabling accurate time-based event correlation.
Question 6: Which SIEM feature allows analysts to search historical log data to reconstruct a timeline of a past security incident?
- Real-time dashboards
- Forensic log search and replay (Correct answer)
- Automated ticketing integration
- Vulnerability scanning
Correct answer: Forensic log search and replay
Forensic log search and replay enables analysts to query retained logs and reconstruct the sequence of events in a past incident.
Question 7: A SIEM rule fires when 5 failed logins occur within 2 minutes from the same IP. What type of attack is this rule designed to detect?
- Phishing campaign
- Brute-force or password-spraying attack (Correct answer)
- SQL injection attempt
- Man-in-the-middle attack
Correct answer: Brute-force or password-spraying attack
Repeated rapid login failures from a single source are a hallmark of brute-force or password-spraying attacks.
CCD Security Information & Event Management 2
Which SIEM component is responsible for normalizing log data from heterogeneous sources into a common format?