CySA+ SIEM Log Review and Correlation Rules Quiz

1. Which data field is most useful for tracking user activities across multiple systems in SIEM?

IP address only

Username and timestamp

File size

Monitor resolution

2. What is the primary advantage of using machine learning in SIEM correlation rules?

Detecting previously unknown attack patterns through behavioral analysis

Eliminating the need for human analysts

Reducing log storage requirements

Automatically updating firewall rules

3. When reviewing SIEM logs, what contextual information helps determine if a privileged account activity is malicious?

The time of day, user role, and typical usage patterns

Only the source IP address

The file extension of accessed documents

The monitor brand used by the user

4. In SIEM, which of the following is an example of a false negative?

An alert for a legitimate user activity flagged as suspicious

An actual security incident that goes undetected

A duplicate alert for the same event

An alert delayed by one hour

5. What is the main purpose of alert severity levels in SIEM correlation rules?

To prioritize analyst response based on threat impact

To determine the color of the alert icon

To limit the number of logs ingested

To encrypt sensitive data

6. True or False: A correlation rule that generates 100 alerts per day is necessarily more effective than one generating 10 alerts per day.

True

False

7. Which of the following best describes alert aggregation in SIEM?

Combining related alerts into a single consolidated alert to reduce noise

Deleting all alerts automatically

Sending alerts to multiple recipients simultaneously

Storing alerts in separate databases

8. In SIEM log review, what does a spike in authentication failures typically suggest?

Successful user login activity

Potential brute force attack or credential compromise

Normal end-of-day system shutdown

Scheduled maintenance window

9. What is the primary challenge when correlating logs from heterogeneous sources?

Sources use different timestamp formats and event naming conventions

All sources generate logs at identical rates

Heterogeneous sources cannot be correlated

Sources transmit encrypted data only

10. True or False: Correlation rules should be created based solely on vendor recommendations without considering your organization's specific environment.

True

False

11. In SIEM systems, what is the primary purpose of log normalization?

Converting logs from different sources into a standardized format for analysis

Deleting duplicate log entries to save storage space

Encrypting sensitive log data before ingestion

Compressing log files to reduce bandwidth usage

12. In SIEM, what does a high-fidelity alert typically indicate?

An alert with a high probability of being a genuine security incident

An alert that generates high bandwidth usage

An alert that requires multiple sensors to trigger

An alert that is delayed in notification

13. What is the significance of event enrichment in SIEM?

Adding contextual information to events to improve detection accuracy

Removing unnecessary fields from logs

Encrypting event data for storage

Slowing down log ingestion for better quality control

14. Which tuning technique helps reduce alert fatigue in SIEM?

Increasing the sensitivity of all correlation rules

Disabling all alerting mechanisms

Adjusting rule thresholds and whitelisting known-good activities

Manually reviewing every single log entry

15. True or False: A single log event from a firewall is typically sufficient to determine if an attack is occurring.

True

False

16. What is the primary function of a SIEM correlation engine?

Storing raw log data indefinitely

Analyzing and linking related events to detect complex attack patterns

Automatically blocking all suspicious traffic

Generating compliance reports only

17. Which log source is typically most critical for detecting lateral movement in a network?

Web server access logs

Authentication and network flow logs

Email gateway logs

Printer status logs

18. In SIEM log review, what is baseline profiling used for?

Establishing normal network and user behavior patterns for anomaly detection

Identifying the physical location of data centers

Determining the cost of security tools

Assigning user access privileges

19. What does a false positive in SIEM alerting mean?

An alert that correctly identifies a genuine security incident

An alert triggered by normal activity that is incorrectly flagged as malicious

An alert that fails to detect an actual security threat

An alert that is delayed in reaching the SOC analyst

20. Which of the following is a key benefit of correlation rules in SIEM?

They reduce the number of logs generated by endpoints

They identify patterns across multiple events that may indicate a security threat

They eliminate the need for firewalls in network security

They automatically patch vulnerabilities in real-time

CySA+ SIEM Log Review and Correlation Rules Quiz

1. Which data field is most useful for tracking user activities across multiple systems in SIEM?

2.

What first name or nickname would you like us to use?

2. What is the primary advantage of using machine learning in SIEM correlation rules?

3. When reviewing SIEM logs, what contextual information helps determine if a privileged account activity is malicious?

4. In SIEM, which of the following is an example of a false negative?

5. What is the main purpose of alert severity levels in SIEM correlation rules?

6. True or False: A correlation rule that generates 100 alerts per day is necessarily more effective than one generating 10 alerts per day.

7. Which of the following best describes alert aggregation in SIEM?

8. In SIEM log review, what does a spike in authentication failures typically suggest?

9. What is the primary challenge when correlating logs from heterogeneous sources?

10. True or False: Correlation rules should be created based solely on vendor recommendations without considering your organization's specific environment.

11. In SIEM systems, what is the primary purpose of log normalization?

12. In SIEM, what does a high-fidelity alert typically indicate?

13. What is the significance of event enrichment in SIEM?

14. Which tuning technique helps reduce alert fatigue in SIEM?

15. True or False: A single log event from a firewall is typically sufficient to determine if an attack is occurring.

16. What is the primary function of a SIEM correlation engine?

17. Which log source is typically most critical for detecting lateral movement in a network?

18. In SIEM log review, what is baseline profiling used for?

19. What does a false positive in SIEM alerting mean?

20. Which of the following is a key benefit of correlation rules in SIEM?