CCD Security Information & Event Management 3

Question 1

Which of the following SIEM use cases best demonstrates User and Entity Behavior Analytics (UEBA)?

Accepted Answer

Detecting a user accessing data volumes 10x above their normal pattern

Answer

UEBA profiles individual user and entity behavior and flags statistical deviations, such as anomalous data access volumes.

Question 2

A SIEM operator wants to reduce storage costs while meeting a 1-year log retention compliance requirement. What is the BEST strategy?

Accepted Answer

Compress and tier old logs to lower-cost cold storage after 30–90 days

Answer

Tiered storage moves older, less-accessed logs to cheaper cold storage while keeping recent logs in fast-access hot storage.

Question 3

In SIEM context, what does 'event enrichment' refer to?

Accepted Answer

Appending additional context such as geolocation or threat intelligence to raw events

Answer

Event enrichment adds contextual data—like IP reputation, geolocation, or asset criticality—to raw log events to improve analysis quality.

Question 4

Which protocol is MOST commonly used to forward syslog messages to a SIEM collector?

Accepted Answer

Syslog over UDP 514 or TCP 514/6514

Answer

Syslog messages are traditionally forwarded on UDP port 514, with TCP 514 or TLS-secured 6514 used for reliable or encrypted transport.

Question 5

An analyst observes that a SIEM alert for 'data exfiltration' fires every time a developer pushes code to an external Git repository. What action should the analyst take?

Accepted Answer

Tune the rule to exclude known developer IPs or the Git service destination

Answer

Rule tuning—adding exceptions for known-good traffic like authorized Git pushes—reduces false positives without eliminating legitimate detection.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Information & Event Management 3