SIEM Quiz: Log Monitoring & Anomaly Detection

1. Which of these is a valid indicator of compromise (IOC) that SIEM can monitor?

Known malicious IP addresses or file hashes attempting to connect to systems

Users sending legitimate emails

Scheduled antivirus updates

Employees accessing company websites

2. Which of the following best describes the role of a security analyst using SIEM?

Investigating alerts, correlating events, and determining if incidents occurred

Writing all company software code

Managing physical server hardware only

Handling only printer support tickets

3. A SIEM alert shows a service account performing interactive logins. Why is this anomalous?

Service accounts should only be used for automated processes, not interactive user sessions

Service accounts never generate log entries

Interactive logins are required for all accounts

Service accounts cannot access the network

4. In SIEM, what does 'tuning' refer to?

Adjusting detection rules to reduce false positives and improve alert accuracy

Increasing network bandwidth

Upgrading hardware components

Changing user passwords

5. Which component of a SIEM system is responsible for collecting logs from various sources?

Log collector or agent

Storage database

Reporting engine

Backup module

6. A SIEM rule detects a user accessing files outside their normal job function at 3 AM. What type of anomaly is this?

Behavioral anomaly based on time and access pattern deviation

Network connectivity issue

Database corruption

Hardware failure alert

7. What is the primary advantage of using SIEM for real-time threat detection?

Immediate identification and alerting of suspicious activities across all systems

Reduction in IT department staff

Elimination of the need for firewalls

Automatic patching of all vulnerabilities

8. Which log retention policy aligns with CompTIA Security+ recommendations for SIEM?

Retain logs for at least 90 days for investigation and compliance purposes

Delete all logs after 24 hours

Retain logs only in RAM without persistent storage

Logs should never be archived

9. A SIEM system detects multiple failed login attempts followed by a successful login from an unusual location. What is this pattern most likely indicating?

A brute force attack or credential compromise attempt

A routine system maintenance activity

A scheduled backup process

A normal user forgetting their password

10. In SIEM, what does the term 'enrichment' refer to?

Adding contextual information to raw log data to improve analysis

Deleting old log entries to free up storage

Converting logs to encrypted format

Creating backup copies of critical logs

11. What is the primary function of a SIEM solution?

Aggregate, normalize, and correlate security event data from multiple sources

Replace traditional firewalls in network architecture

Encrypt all log files before storage

Automatically patch all vulnerable systems

12. What is data exfiltration, and why is it important to detect via SIEM?

Unauthorized transfer of sensitive data outside the organization; detection prevents data breaches

The process of backing up data to cloud storage

Compressing data files for faster transmission

Deleting temporary files from user workstations

13. Which event would typically trigger a SIEM alert for potential privilege escalation?

A standard user account executing commands with administrative privileges

A user logging in during normal business hours

A backup process completing successfully

An employee opening a document from email

14. What is the primary purpose of setting baseline metrics in SIEM?

To establish normal behavior patterns for comparison and anomaly detection

To encrypt all outgoing network traffic

To reduce the total number of logs collected

To eliminate the need for security analysts

15. Which of the following is a characteristic of a false positive in SIEM alerting?

An alert triggered for legitimate activity that resembles a security threat

An actual security incident that was not detected

A malware infection that bypassed all defenses

A log entry that cannot be parsed

16. A user account logs in from two geographically distant locations within 5 minutes. What type of anomaly is this?

Impossible travel or location-based anomaly

Data exfiltration event

Privilege escalation attempt

Denial of service attack

17. In SIEM, what does correlation mean?

Linking multiple events together to identify patterns or attack chains

Storing logs in a database

Filtering out false positive alerts

Compressing log file sizes

18. Which log source would be MOST critical for detecting unauthorized login attempts?

Authentication and access logs from domain controllers or AAA servers

Application performance monitoring logs

Web server HTTP access logs only

Printer device logs

19. What is an anomaly in the context of SIEM and log monitoring?

Any deviation from established baseline behavior or expected patterns

A type of malware that evades antivirus detection

A network protocol used for secure communication

A backup copy of critical system logs

20. Which of the following best describes log normalization in SIEM?

Converting log data from different sources into a standardized format

Deleting duplicate log entries to save storage

Encrypting logs with AES-256

Compressing logs to reduce bandwidth usage

SIEM Quiz: Can You Spot the Anomaly?