CCP SIEM & Threat Detection 3 — Questions and Answers
Question 1: What is a Security Orchestration, Automation, and Response (SOAR) platform's primary advantage over a standalone SIEM?
- SOAR provides better log storage capacity
- SOAR automates response actions and integrates workflows to reduce manual analyst effort (Correct answer)
- SOAR collects more log sources than SIEM
- SOAR replaces the need for threat intelligence feeds
Correct answer: SOAR automates response actions and integrates workflows to reduce manual analyst effort
SOAR platforms automate repetitive response tasks (like blocking IPs or isolating hosts) and orchestrate cross-tool workflows, significantly reducing analyst workload and response time.
Question 2: During a threat hunt, an analyst searches for processes making DNS queries to randomly generated domain names. What threat does this technique help identify?
- SQL injection attacks
- Domain Generation Algorithm (DGA) malware (Correct answer)
- ARP poisoning attacks
- Man-in-the-middle SSL stripping
Correct answer: Domain Generation Algorithm (DGA) malware
Domain Generation Algorithms (DGAs) are used by malware to generate many pseudo-random domain names as potential C2 contact points, making them hard to blacklist.
Question 3: What does a high false negative rate in a SIEM indicate?
- The SIEM is generating too many irrelevant alerts
- The SIEM is missing real attacks that should have been detected (Correct answer)
- The SIEM correlation rules are overly sensitive
- The SIEM log collection is duplicating events
Correct answer: The SIEM is missing real attacks that should have been detected
A high false negative rate means the system fails to alert on actual malicious activity, leaving real threats undetected — a critical gap in security coverage.
Question 4: Which log source is most valuable for detecting lateral movement within a Windows environment?
- Web server access logs
- Windows Security Event logs (e.g., Event ID 4624, 4648) (Correct answer)
- DNS query logs from the perimeter firewall
- DHCP server lease logs
Correct answer: Windows Security Event logs (e.g., Event ID 4624, 4648)
Windows Security Event logs capture authentication events (logon types, source IPs, account names) that are essential for detecting lateral movement via credential reuse or pass-the-hash.
Question 5: What is 'alert fatigue' in a SOC environment?
- Physical exhaustion of SOC analysts from overnight shifts
- Desensitization of analysts due to an overwhelming volume of low-quality alerts (Correct answer)
- A SIEM performance issue caused by too many correlation rules
- Network congestion caused by excessive log forwarding
Correct answer: Desensitization of analysts due to an overwhelming volume of low-quality alerts
Alert fatigue occurs when analysts receive so many alerts — especially false positives — that they become desensitized and may miss genuine threats buried in the noise.
Question 6: Which technique would an attacker use to avoid detection by time-based SIEM correlation rules?
- Encrypting C2 communications
- Low-and-slow attack pacing to stay below detection thresholds (Correct answer)
- Using legitimate admin tools (living off the land)
- Pivoting through multiple compromised hosts
Correct answer: Low-and-slow attack pacing to stay below detection thresholds
Low-and-slow attacks spread malicious activity over extended time periods, intentionally staying below rate-based SIEM thresholds that would trigger on rapid activity.
Question 7: What is the primary function of threat intelligence feeds integrated into a SIEM?
- To automatically patch vulnerable systems
- To provide indicators of compromise (IOCs) for matching against collected log data (Correct answer)
- To train machine learning models for anomaly detection
- To encrypt sensitive log data during transmission
Correct answer: To provide indicators of compromise (IOCs) for matching against collected log data
Threat intelligence feeds supply known malicious IOCs (IPs, domains, file hashes) that the SIEM matches against ingested logs to identify connections to known threat actors.
CCP SIEM & Threat Detection 3
What is a Security Orchestration, Automation, and Response (SOAR) platform's primary advantage over a standalone SIEM?