SIEM Correlation Alert Investigation Quiz

1. When investigating a SIEM alert, what is the primary purpose of threat intelligence enrichment?

To increase alert volume

To provide context about malicious IPs, domains, or hashes

To replace manual analysis

To delete suspicious events

2. When documenting a SIEM investigation for compliance, which element is most critical to include?

Personal opinions about the threat actor

Timeline of events with timestamps and evidence sources

Recommendations for salary increases

Estimated cost of the breach

3. A SIEM correlation alert combines three separate security events within a 5-minute window. What is this detection method called?

Sequential correlation

Temporal correlation

Statistical correlation

Spatial correlation

4. In incident response, which step immediately follows SIEM alert triage and validation?

Containment and eradication

System restoration

Scope determination and evidence collection

Public disclosure

5. A SIEM alert shows a service account performing interactive logins, which is abnormal. This is an example of what type of anomaly detection?

Signature-based detection

Behavioral anomaly detection

Rule-based detection

Threshold-based detection

6. When a SIEM correlation alert triggers, what does 'baselining' refer to in the investigation context?

Comparing activity against normal user behavior patterns

Creating a backup of all logs

Resetting the SIEM database

Sending alerts to email

7. An analyst reviews a SIEM alert for privilege escalation. Which Windows event ID is most relevant?

4624 (successful login)

4672 (special privileges assigned)

4688 (process creation)

4720 (user account created)

8. During forensic investigation of a SIEM alert, what is the correct order of volatile data preservation?

Network connections, RAM, disk, logs

Disk, logs, network connections, RAM

RAM, network connections, logs, disk

Logs, disk, RAM, network connections

9. True or False: SIEM correlation rules should be tuned to alert on every possible security event to maximize detection.

True

False

10. A SIEM alert indicates unusual outbound traffic on port 443 from a workstation. Which log source would best confirm this is HTTPS traffic versus tunneling?

Firewall logs only

Endpoint DNS logs and SSL/TLS certificate validation

Router ARP tables

DHCP lease records

11. A SIEM correlation alert triggers when a user account fails authentication 15 times in 2 minutes from different source IPs. What attack pattern does this indicate?

Credential stuffing attack

Man-in-the-middle attack

SQL injection attempt

Privilege escalation

12. An analyst discovers that a SIEM alert for data exfiltration was triggered by a scheduled backup job. How should this be handled?

Ignore all similar alerts

Disable the correlation rule

Adjust the rule to exclude the backup process

Escalate to management immediately

13. Which metric is most important when tuning SIEM correlation rules to reduce false positives?

Specificity and precision

Processing speed

Storage capacity

Network bandwidth

14. A SIEM correlation rule combines data from firewall, proxy, and endpoint logs. This approach is called?

Log aggregation

Multi-source correlation

Event normalization

Threat enrichment

15. During incident investigation, an analyst needs to preserve evidence chain of custody. Which action is NOT appropriate?

Document all access to the evidence

Make a forensic image before analysis

Modify timestamps to match alert times

Record who handled evidence and when

16. What does the term 'false positive' mean in SIEM correlation rules?

An alert triggered by legitimate user activity

An undetected security breach

A delayed alert notification

A corrupted log file

17. A SIEM alert shows multiple failed login attempts followed by a successful login using a service account. What investigation technique should you apply first?

Check for password policy violations

Review account lockout policies

Correlate with network traffic logs

Examine privileged activity after successful login

18. Which log source provides the most reliable evidence of lateral movement within a network?

Web server access logs

Windows Event Logs (4688, 4624)

DNS query logs

DHCP server logs

19. An analyst receives a SIEM alert showing a user accessing sensitive files at 3 AM on a weekend. What is the first step in investigation?

Immediately disable the user account

Review user baseline behavior and context

Escalate to law enforcement

Delete the alert from the system

20. Which SIEM component is responsible for normalizing log data from multiple sources into a standardized format?

Parser

Correlator

Aggregator

Enricher

Security Analyst Investigating a SIEM Correlation Alert Quiz