CCD Security Information & Event Management 4

Question 1

A SIEM detects a spike in DNS queries to newly registered domains from multiple internal hosts simultaneously. What threat does this MOST likely indicate?

Accepted Answer

Domain generation algorithm (DGA) malware beaconing

Answer

DGA malware generates many pseudo-random domain names to locate C2 servers, resulting in high volumes of queries to newly registered or unknown domains.

Question 2

Which SIEM integration enables automated ticket creation in a helpdesk system when a high-severity alert fires?

Accepted Answer

SOAR (Security Orchestration, Automation, and Response) playbook integration

Answer

SOAR playbooks can automate response actions including ticket creation, enrichment, and notification when triggered by SIEM alerts.

Question 3

What does the term 'EPS' mean in the context of SIEM sizing?

Accepted Answer

Events Per Second — a measure of ingestion throughput

Answer

EPS (Events Per Second) measures how many log events a SIEM must ingest and process, which determines hardware and licensing requirements.

Question 4

An attacker exfiltrates data by encoding it in DNS TXT records. Which SIEM data source would BEST help detect this?

Accepted Answer

DNS server query logs with TXT record visibility

Answer

DNS server logs capturing TXT record query volume and size can reveal DNS tunneling used to exfiltrate data covertly.

Question 5

Which framework is commonly used to map SIEM detection rules to known adversary tactics and techniques?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK provides a structured taxonomy of adversary tactics and techniques that SIEM rules can be mapped to for coverage analysis.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Information & Event Management 4