CySA+ SIEM Log Review Correlation Rules

1. Which correlation rule pattern detects privilege escalation attempts?

Failed login followed by successful admin access

Routine file access patterns

Normal business hour traffic

Standard DNS queries

2. In SIEM log review, what indicates a potential brute-force attack pattern?

Single successful login event

Multiple failed login attempts from same source in short timeframe

Normal user logout events

Scheduled system maintenance logs

3. What metric should be monitored to identify potential insider threats through SIEM?

CPU utilization only

User access patterns, file modifications, and data transfers

Network latency

Application version numbers

4. Which SIEM capability helps reduce alert fatigue for security analysts?

Increasing the number of data sources

Intelligent alert filtering and correlation thresholds

Removing all security controls

Disabling log normalization

5. In threat hunting, how are SIEM logs used to identify compromised accounts?

Analyzing patterns of unusual access, locations, and times

Randomly selecting user accounts

Monitoring only successful logins

Reviewing network bandwidth usage exclusively

6. What does the correlation rule condition 'OR' accomplish versus 'AND'?

'OR' requires all conditions; 'AND' requires any one condition

'OR' requires any one condition; 'AND' requires all conditions

'OR' and 'AND' are functionally identical

'OR' eliminates alerts while 'AND' creates them

7. Which element is critical for maintaining log integrity in security operations?

Real-time compression of log files

Immutable log storage and chain of custody

Automated deletion of all events

Disabling log encryption

8. In SIEM, what is the function of a whitelist in correlation rules?

Blocks all traffic permanently

Excludes known legitimate activities from triggering alerts

Encrypts sensitive log data

Increases event processing speed

9. Which log type should be prioritized for detecting data exfiltration?

System event logs

Network traffic and data loss prevention logs

Application performance logs

Printer activity logs

10. What does alert aggregation in SIEM accomplish?

Combines related alerts into single incidents for investigation

Increases the volume of notifications sent

Deletes alerts automatically

Prevents log collection entirely

11. What is the primary purpose of correlation rules in a SIEM system?

Archive logs to storage systems

Link related events to detect complex attack patterns

Encrypt log data in transit

Reduce storage capacity requirements

12. In incident response, why is log correlation across multiple sources important?

To reduce compliance reporting requirements

To reconstruct attack sequences and scope compromises

To eliminate the need for forensic analysis

To automatically remediate all threats

13. What is the purpose of baselining in SIEM security operations?

To establish normal activity patterns for anomaly detection

To permanently block all suspicious traffic

To eliminate all logging capabilities

To reduce alert notification frequency

14. Which log field is essential for performing user behavior analytics in SIEM?

Timestamp only

User identity and associated actions

Network packet size

System uptime duration

15. When tuning SIEM correlation rules, which adjustment reduces false positives?

Decreasing the event threshold

Increasing the time window size

Increasing the event threshold or adding exceptions

Removing all baseline data

16. What is the primary advantage of normalizing logs from multiple sources?

Reduces the total number of events

Enables consistent analysis across heterogeneous systems

Improves network bandwidth efficiency

Eliminates the need for log retention policies

17. Which metric is used to measure the effectiveness of correlation rules in detecting true threats?

False positive rate

Log ingestion speed

Detection rate or sensitivity

Storage utilization percentage

18. In SIEM log correlation, what does time-based windowing accomplish?

Groups events occurring within a specified time frame

Compresses log file sizes automatically

Filters out events older than 90 days

Encrypts logs during specific hours

19. What does a false positive in SIEM alerting mean?

An alert that correctly identifies a real threat

An alert triggered by normal activity misidentified as malicious

A missed detection of an actual security incident

An alert with incomplete log data

20. Which log source is typically most critical for detecting unauthorized access attempts?

Application performance metrics

Authentication and access control logs

Network bandwidth utilization

System disk space alerts

CySA+ SIEM Log Review and Correlation Rules Quiz