CCP SIEM & Threat Detection 2

Question 1

Which SIEM component is responsible for normalizing log data from disparate sources into a common format?

Accepted Answer

Data normalization parser

Answer

Data normalization parsers translate raw logs from different formats (syslog, Windows Event Log, JSON) into a unified schema for consistent analysis.

Question 2

An analyst notices thousands of failed SSH login attempts from a single IP, followed by one successful login. What attack stage does this most likely represent?

Accepted Answer

Brute force attack culminating in successful authentication

Answer

Many failed logins followed by one success is the classic signature of a brute force attack where the attacker eventually guesses the correct password.

Question 3

What is the purpose of a SIEM use case library?

Accepted Answer

To define pre-built detection rules and alert logic for known attack patterns

Answer

A use case library contains pre-built detection logic, correlation rules, and alert thresholds mapped to known attack techniques, accelerating threat detection.

Question 4

Which metric measures the percentage of actual threats correctly identified by a detection system?

Accepted Answer

Recall (sensitivity)

Answer

Recall (sensitivity) measures the ratio of true positives to all actual positive cases, indicating how many real threats the system successfully detects.

Question 5

A SIEM rule triggers an alert every time a user accesses more than 50 files within 5 minutes. What type of detection logic is this?

Accepted Answer

Anomaly threshold detection

Answer

Triggering on a fixed count threshold (50 files in 5 minutes) is anomaly threshold detection, which flags activity exceeding defined limits.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP SIEM & Threat Detection 2