CCD Security Information & Event Management 5

Question 1

A SOC analyst must demonstrate regulatory compliance by showing all privileged user activity was logged for the past 12 months. Which SIEM capability supports this requirement?

Accepted Answer

Long-term log retention with tamper-evident audit trails

Answer

Compliance reporting relies on long-term, tamper-evident log retention that proves privileged user activity was captured and unaltered.

Question 2

What is the purpose of a 'lookup table' (reference data) in SIEM rule logic?

Accepted Answer

To allow rules to reference external lists like known bad IPs or authorized service accounts

Answer

Lookup tables let correlation rules reference external data sets—such as threat intel IP lists or whitelisted accounts—to improve accuracy.

Question 3

During incident response, an analyst needs to determine which internal host first communicated with a malicious IP. Which SIEM query type is MOST appropriate?

Accepted Answer

Historical forensic search filtered by destination IP and sorted by earliest timestamp

Answer

A historical search filtered by the malicious destination IP and sorted chronologically identifies the patient-zero host and initial contact time.

Question 4

Which of the following BEST describes 'threat hunting' in relation to a SIEM?

Accepted Answer

Proactively querying SIEM data to find threats that have evaded automated detection

Answer

Threat hunting involves analysts actively searching SIEM data for indicators of compromise that automated rules have not yet detected.

Question 5

A SIEM alert fires for 'Impossible Travel' — a user authenticated from New York at 9:00 AM and then from London at 9:15 AM. What does this indicate?

Accepted Answer

Possible credential compromise or account sharing across geographically distant locations

Answer

Impossible travel alerts flag authentication from two geographically distant locations within a time window physically impossible to bridge, suggesting stolen credentials.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Security Information & Event Management 5