CCP SIEM & Threat Detection 2 — Questions and Answers
Question 1: Which SIEM component is responsible for normalizing log data from disparate sources into a common format?
- Event correlation engine
- Log aggregator
- Data normalization parser (Correct answer)
- Threat intelligence feed
Correct answer: Data normalization parser
Data normalization parsers translate raw logs from different formats (syslog, Windows Event Log, JSON) into a unified schema for consistent analysis.
Question 2: An analyst notices thousands of failed SSH login attempts from a single IP, followed by one successful login. What attack stage does this most likely represent?
- Lateral movement after initial access
- Credential stuffing leading to account compromise
- Brute force attack culminating in successful authentication (Correct answer)
- Pass-the-hash attack against SSH
Correct answer: Brute force attack culminating in successful authentication
Many failed logins followed by one success is the classic signature of a brute force attack where the attacker eventually guesses the correct password.
Question 3: What is the purpose of a SIEM use case library?
- To store raw log data for long-term retention
- To define pre-built detection rules and alert logic for known attack patterns (Correct answer)
- To manage user access to the SIEM platform
- To configure network sensors and data collectors
Correct answer: To define pre-built detection rules and alert logic for known attack patterns
A use case library contains pre-built detection logic, correlation rules, and alert thresholds mapped to known attack techniques, accelerating threat detection.
Question 4: Which metric measures the percentage of actual threats correctly identified by a detection system?
- Specificity
- Precision
- Recall (sensitivity) (Correct answer)
- F1 score
Correct answer: Recall (sensitivity)
Recall (sensitivity) measures the ratio of true positives to all actual positive cases, indicating how many real threats the system successfully detects.
Question 5: A SIEM rule triggers an alert every time a user accesses more than 50 files within 5 minutes. What type of detection logic is this?
- Signature-based detection
- Anomaly threshold detection (Correct answer)
- Heuristic behavioral analysis
- Machine learning classification
Correct answer: Anomaly threshold detection
Triggering on a fixed count threshold (50 files in 5 minutes) is anomaly threshold detection, which flags activity exceeding defined limits.
Question 6: What does 'event enrichment' mean in the context of SIEM?
- Encrypting log data before storage
- Adding contextual information (e.g., geolocation, asset criticality) to raw events (Correct answer)
- Compressing logs to reduce storage overhead
- Filtering out low-priority events before ingestion
Correct answer: Adding contextual information (e.g., geolocation, asset criticality) to raw events
Event enrichment adds contextual metadata such as user identity, asset ownership, geolocation, or threat intelligence data to raw log events, improving analyst decision-making.
Question 7: Which MITRE ATT&CK tactic involves adversaries trying to steal credentials to gain further access?
- Discovery
- Credential Access (Correct answer)
- Privilege Escalation
- Collection
Correct answer: Credential Access
The Credential Access tactic in MITRE ATT&CK covers techniques adversaries use to steal account names and passwords, such as keylogging or credential dumping.
CCP SIEM & Threat Detection 2
Which SIEM component is responsible for normalizing log data from disparate sources into a common format?