CCD Security Information & Event Management 2

Question 1

Which SIEM component is responsible for normalizing log data from heterogeneous sources into a common format?

Accepted Answer

Log normalization parser

Answer

The log normalization parser transforms raw log data from diverse sources into a consistent, structured format for analysis.

Question 2

A SIEM generates an alert every time a user logs in outside business hours. After a week, analysts begin ignoring these alerts. This is an example of:

Accepted Answer

Alert fatigue caused by excessive false positives

Answer

Alert fatigue occurs when too many low-fidelity or false-positive alerts cause analysts to desensitize and miss real threats.

Question 3

What is the primary purpose of baselining in a SIEM environment?

Accepted Answer

To establish normal behavior so anomalies can be detected

Answer

Baselining establishes what 'normal' activity looks like so that deviations—potential threats—trigger meaningful alerts.

Question 4

Which log source would be MOST valuable in a SIEM for detecting lateral movement within a network?

Accepted Answer

Windows Security Event Logs (authentication/logon events)

Answer

Windows Security Event Logs capture authentication and logon events that reveal account usage patterns indicative of lateral movement.

Question 5

An analyst notices that SIEM correlation rules are triggering alerts based on mismatched timestamps between sources. What is the BEST remediation?

Accepted Answer

Implement NTP synchronization across all log sources

Answer

NTP synchronization ensures all devices report consistent timestamps, enabling accurate time-based event correlation.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Information & Event Management 2