CCP SIEM & Threat Detection 3

Question 1

What is a Security Orchestration, Automation, and Response (SOAR) platform's primary advantage over a standalone SIEM?

Accepted Answer

SOAR automates response actions and integrates workflows to reduce manual analyst effort

Answer

SOAR platforms automate repetitive response tasks (like blocking IPs or isolating hosts) and orchestrate cross-tool workflows, significantly reducing analyst workload and response time.

Question 2

During a threat hunt, an analyst searches for processes making DNS queries to randomly generated domain names. What threat does this technique help identify?

Accepted Answer

Domain Generation Algorithm (DGA) malware

Answer

Domain Generation Algorithms (DGAs) are used by malware to generate many pseudo-random domain names as potential C2 contact points, making them hard to blacklist.

Question 3

What does a high false negative rate in a SIEM indicate?

Accepted Answer

The SIEM is missing real attacks that should have been detected

Answer

A high false negative rate means the system fails to alert on actual malicious activity, leaving real threats undetected — a critical gap in security coverage.

Question 4

Which log source is most valuable for detecting lateral movement within a Windows environment?

Accepted Answer

Windows Security Event logs (e.g., Event ID 4624, 4648)

Answer

Windows Security Event logs capture authentication events (logon types, source IPs, account names) that are essential for detecting lateral movement via credential reuse or pass-the-hash.

Question 5

What is 'alert fatigue' in a SOC environment?

Accepted Answer

Desensitization of analysts due to an overwhelming volume of low-quality alerts

Answer

Alert fatigue occurs when analysts receive so many alerts — especially false positives — that they become desensitized and may miss genuine threats buried in the noise.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP SIEM & Threat Detection 3