CCD Security Information & Event Management 3 — Questions and Answers
Question 1: Which of the following SIEM use cases best demonstrates User and Entity Behavior Analytics (UEBA)?
- Alerting when firewall rules are modified
- Detecting a user accessing data volumes 10x above their normal pattern (Correct answer)
- Blocking inbound traffic from known malicious IPs
- Correlating IDS signatures with CVE identifiers
Correct answer: Detecting a user accessing data volumes 10x above their normal pattern
UEBA profiles individual user and entity behavior and flags statistical deviations, such as anomalous data access volumes.
Question 2: A SIEM operator wants to reduce storage costs while meeting a 1-year log retention compliance requirement. What is the BEST strategy?
- Delete logs older than 90 days
- Compress and tier old logs to lower-cost cold storage after 30–90 days (Correct answer)
- Store all logs in RAM-backed hot storage
- Retain only firewall logs and discard others
Correct answer: Compress and tier old logs to lower-cost cold storage after 30–90 days
Tiered storage moves older, less-accessed logs to cheaper cold storage while keeping recent logs in fast-access hot storage.
Question 3: In SIEM context, what does 'event enrichment' refer to?
- Increasing the severity score of all events
- Appending additional context such as geolocation or threat intelligence to raw events (Correct answer)
- Encrypting events before storage
- Forwarding events to a secondary SIEM
Correct answer: Appending additional context such as geolocation or threat intelligence to raw events
Event enrichment adds contextual data—like IP reputation, geolocation, or asset criticality—to raw log events to improve analysis quality.
Question 4: Which protocol is MOST commonly used to forward syslog messages to a SIEM collector?
- SNMP trap over TCP 162
- Syslog over UDP 514 or TCP 514/6514 (Correct answer)
- NetFlow over UDP 2055
- LDAP over TCP 389
Correct answer: Syslog over UDP 514 or TCP 514/6514
Syslog messages are traditionally forwarded on UDP port 514, with TCP 514 or TLS-secured 6514 used for reliable or encrypted transport.
Question 5: An analyst observes that a SIEM alert for 'data exfiltration' fires every time a developer pushes code to an external Git repository. What action should the analyst take?
- Block all external Git traffic
- Tune the rule to exclude known developer IPs or the Git service destination (Correct answer)
- Accept the alert as a true positive and escalate
- Remove the exfiltration detection rule entirely
Correct answer: Tune the rule to exclude known developer IPs or the Git service destination
Rule tuning—adding exceptions for known-good traffic like authorized Git pushes—reduces false positives without eliminating legitimate detection.
Question 6: What is the function of a SIEM's 'watchlist' or 'asset criticality' feature?
- Automatically patching high-value assets
- Prioritizing alerts involving high-value or high-risk assets or users (Correct answer)
- Blocking traffic to assets on the watchlist
- Scheduling vulnerability scans for listed assets
Correct answer: Prioritizing alerts involving high-value or high-risk assets or users
Asset criticality and watchlists cause the SIEM to elevate the priority of alerts involving designated high-value targets.
Question 7: Which of the following best describes a 'correlation rule' in a SIEM?
- A cryptographic hash used to verify log integrity
- A logic statement that combines multiple events or conditions to generate a higher-fidelity alert (Correct answer)
- A firewall policy automatically applied based on threat score
- A user role controlling access to SIEM dashboards
Correct answer: A logic statement that combines multiple events or conditions to generate a higher-fidelity alert
Correlation rules define conditional logic that links multiple individual events into a composite, higher-confidence security alert.
CCD Security Information & Event Management 3
Which of the following SIEM use cases best demonstrates User and Entity Behavior Analytics (UEBA)?