SIEM & Log Analysis Quiz for CySA+ Certification

1. A SIEM playbook typically includes:

Documented procedures for responding to detected security events

Network topology diagrams only

Hardware specifications

User password policies

Submit

5. Which SIEM feature enables automatic response to detected threats?

Automated playbooks and orchestration

Manual log review

Email notifications only

Archive aging

6. A spike in failed authentication events across multiple systems may indicate:

A brute force attack or credential compromise

Normal end-of-month activity

Scheduled system maintenance

Increased user productivity

7. In threat hunting, SIEM logs help analysts identify:

Previously undetected suspicious activities and attack patterns

Only confirmed known threats

Hardware failures exclusively

User satisfaction metrics

8. Which protocol is commonly used to send logs to a SIEM system securely?

Syslog over TLS

HTTP without encryption

FTP

Telnet

9. What does the term 'log retention' refer to in SIEM?

The duration logs are stored before deletion or archival

Encrypting log files

Filtering out sensitive data

Compressing log file sizes

10. When analyzing logs for data exfiltration, which indicator is most suspicious?

Large data transfer to an external IP at unusual hours

Normal business hours file access

Standard internal network traffic

Routine software updates

11. What is the primary function of a Security Information and Event Management (SIEM) system?

Aggregate, normalize, and analyze security logs from multiple sources

Encrypt all network traffic between endpoints

Manage user access control policies only

Replace all antivirus software on endpoints

12. Which log field is most important when investigating a failed login attempt?

Source IP address and timestamp

Printer model number

Email domain name

Operating system version

13. In log analysis, a baseline is used to:

Delete unnecessary log entries

Establish normal network behavior for anomaly detection

Encrypt all security events

Reduce SIEM processing power

14. What is the primary advantage of centralizing logs in a SIEM?

Enables faster threat detection across the entire infrastructure

Reduces the need for security analysts

Eliminates the need for firewalls

Decreases network latency

15. Which metric helps measure SIEM effectiveness in detecting security incidents?

Mean time to detect (MTTD)

Total storage capacity used

Number of archived logs

System uptime percentage

16. A successful SIEM deployment requires tuning detection rules to:

Block all network traffic

Balance sensitivity and specificity to reduce false positives

Only alert on critical vulnerabilities

Eliminate all authentication logs

17. Which of the following is a common challenge when implementing SIEM across an enterprise?

Too few log sources to analyze

Managing alert fatigue from excessive false positives

Lack of security threats to detect

Insufficient network bandwidth for emails

18. What does log normalization accomplish in a SIEM system?

Converts logs from different sources into a standard format

Permanently deletes old log entries

Increases log file size for archival

Prevents unauthorized log access

19. In SIEM, event correlation is used to:

Delete redundant log entries

Connect multiple related events to identify complex attack patterns

Reduce storage costs

Encrypt sensitive log data

20. Which log source is most critical for detecting lateral movement within a network?

Web server access logs

Windows Event logs and authentication events

Printer device logs

Email bounce-back messages

SIEM Quiz: Can You Read the Logs Like an Analyst?