Back to Subject

Unit 3: Endpoint, SIEM, and Security Analytics - Practice Quiz

INT244 — Securing Computing Systems 60 Questions
0 Correct 0 Wrong 60 Left
0/60

1 What is the main purpose of Endpoint Detection and Response (EDR)?

Endpoint Analysis and Threat Hunting: endpoint detection and response Easy
A. Create office documents
B. Manage internet subscriptions
C. Monitor and investigate endpoint activity
D. Design computer hardware

2 What is malware analysis used to determine?

Endpoint Analysis and Threat Hunting: malware analysis and reverse engineering Easy
A. The physical size of a server
B. The behavior and purpose of malware
C. The age of a computer monitor
D. The price of a software license

3 What does an asset-focused risk model primarily consider?

Endpoint Analysis and Threat Hunting: data and asset-focused risk models Easy
A. The color of network cables
B. The value and importance of assets
C. The number of computer keyboards
D. The brand of office furniture

4 Which principle is important for endpoint security?

Endpoint Analysis and Threat Hunting: principles of endpoint security Easy
A. Keep systems updated and protected
B. Allow unknown programs to run
C. Disable all security monitoring
D. Share passwords between users

5 What is a primary function of a SIEM system?

Security Information and Event Management: fundamentals of SIEM Easy
A. Collect and analyze security logs
B. Increase monitor brightness
C. Create graphic design files
D. Replace all network cables

6 What does distributed processing in SIEM generally involve?

Security Information and Event Management: distributed processing Easy
A. Printing security alerts for manual filing
B. Storing every log on one personal computer
C. Removing all duplicate user accounts
D. Sharing processing across multiple systems

7 What is the goal of accelerated threat hunting?

Security Information and Event Management: accelerated threat hunting Easy
A. Replace backups with temporary files
B. Reduce the number of security analysts
C. Delay investigations until the end of the month
D. Find threats more quickly

8 How can SIEM support regulatory reporting?

Security Information and Event Management: regulatory reporting with SIEM Easy
A. By repairing damaged computer screens
B. By approving employee vacation requests
C. By selecting a company's business logo
D. By providing stored security event records

9 What is infrastructure management in a SIEM environment concerned with?

Security Information and Event Management: infrastructure management Easy
A. Choosing colors for presentation slides
B. Managing personal social media accounts
C. Maintaining SIEM systems and components
D. Ordering food for security staff

10 What does a SIEM log retention strategy define?

Security Information and Event Management: SIEM log retention strategies Easy
A. How many employees may use email
B. How much printer ink should be ordered
C. How often monitors should be cleaned
D. How long logs should be kept

11 What is an example of automated response by a SIEM?

Security Information and Event Management: automated response and remediation Easy
A. Changing the office lighting schedule
B. Writing a report without any event data
C. Replacing a user's keyboard automatically
D. Blocking a suspicious network address

12 What activity is central to threat hunting with SIEM?

Security Information and Event Management: threat hunting with SIEM Easy
A. Deleting logs before reviewing them
B. Ignoring unusual login activity
C. Searching logs for suspicious patterns
D. Installing unrelated entertainment software

13 Which is an operational requirement for an effective SIEM?

Security Information and Event Management: operational requirements Easy
A. Accurate and timely log collection
B. A completely disconnected monitoring process
C. A policy of ignoring low-volume alerts
D. A system that stores events without timestamps

14 What does User and Entity Behavior Analytics (UEBA) examine?

Security Analytics and Machine Learning in SOC: behavioral analytics and UEBA Easy
A. The color settings of user interfaces
B. The speed of document printing
C. User and system behavior
D. The physical design of office buildings

15 How can machine learning support security analytics?

Security Analytics and Machine Learning in SOC: ML-based security analytics Easy
A. By guaranteeing that no future attack can occur
B. By eliminating the need for all security policies
C. By replacing every network device with a machine-learning server
D. By identifying patterns in security data

16 What is the purpose of deploying a predictive security model?

Security Analytics and Machine Learning in SOC: deployment of predictive models Easy
A. Estimate the likelihood of future threats
B. Guarantee that every alert is correct
C. Remove the need to collect security data
D. Prevent analysts from reviewing important security events

17 What does anomaly detection attempt to identify?

Security Analytics and Machine Learning in SOC: anomaly detection in SOC Easy
A. Routine events that exactly match established patterns
B. Activity that differs from normal behavior
C. Only events that occur during business hours
D. All activity performed by system administrators

18 Why does a SIEM correlate events from different sources?

Security Information and Event Management: fundamentals of SIEM Easy
A. To identify relationships between events
B. To make unrelated events impossible to record
C. To ensure that every alert has the same priority
D. To replace authentication with simple usernames

19 What is reverse engineering of malware?

Endpoint Analysis and Threat Hunting: malware analysis and reverse engineering Easy
A. Improving the graphics of a security dashboard
B. Deleting every application from an endpoint
C. Examining how malicious software works
D. Transferring malware to production systems for testing

20 What is remediation in incident response?

Security Information and Event Management: automated response and remediation Easy
A. Fixing or reducing the effects of a threat
B. Collecting unrelated business documents
C. Increasing the number of unreviewed alerts
D. Disabling every security control permanently

21 An EDR tool detects PowerShell launching from a document reader, followed by credential access and an outbound connection to an unknown domain. What is the most appropriate initial analyst action?

Endpoint Analysis and Threat Hunting: endpoint detection and response Medium
A. Delete the document reader from the endpoint
B. Close the alert because PowerShell is an approved tool
C. Review the endpoint process tree and related telemetry
D. Disable all PowerShell activity across the organization

22 A suspicious executable shows no network activity during static analysis, but sandbox analysis reveals periodic DNS requests and encrypted outbound traffic. What does this difference most strongly suggest?

Endpoint Analysis and Threat Hunting: malware analysis and reverse engineering Medium
A. The sandbox is unable to analyze executable files
B. The file is probably a harmless system utility
C. The sample may use runtime behavior or delayed execution
D. The static analysis proves the file is not malicious

23 Two endpoints have the same vulnerability. One stores public marketing files, while the other processes payment information. Which risk-modeling decision is most appropriate?

Endpoint Analysis and Threat Hunting: data and asset-focused risk models Medium
A. Assign identical risk because the vulnerability is identical
B. Prioritize the marketing endpoint because it has more files
C. Prioritize the payment endpoint because data impact is higher
D. Ignore the vulnerability on both endpoints until exploitation occurs

24 An organization wants to reduce the impact of compromised user laptops. Which control best applies the principle of least privilege?

Endpoint Analysis and Threat Hunting: principles of endpoint security Medium
A. Give all users local administrator rights
B. Allow unrestricted software installation by users
C. Provide standard accounts and controlled elevation
D. Require users to share one administrator account

25 A SIEM receives authentication, firewall, and endpoint events. Why is normalization important before correlation?

Security Information and Event Management: fundamentals of SIEM Medium
A. It guarantees that every alert is a confirmed incident
B. It prevents analysts from viewing raw event data
C. It converts different event formats into comparable fields
D. It removes all duplicate events permanently

26 A global organization sends logs to regional collectors before forwarding selected data to a central SIEM. What is a primary benefit of this design?

Security Information and Event Management: distributed processing Medium
A. It reduces latency and distributes ingestion workload
B. It eliminates the need for time synchronization
C. It prevents regional analysts from investigating events
D. It guarantees that no logs will be lost

27 A threat hunter suspects that a known malicious hash executed during the previous 30 days. Which SIEM capability most directly accelerates the investigation?

Security Information and Event Management: accelerated threat hunting Medium
A. Searching indexed endpoint events by file hash
B. Manually opening every endpoint log file
C. Reviewing only the latest firewall dashboard
D. Waiting for a new antivirus signature alert

28 An auditor requests evidence of privileged-access reviews for the last quarter. Which SIEM feature best supports this request?

Security Information and Event Management: regulatory reporting with SIEM Medium
A. A list of unused software licenses
B. A report based on time-stamped access and review events
C. A dashboard showing current CPU usage
D. A monthly count of blocked advertisements

29 A SIEM begins missing events after a new log source is added. Which infrastructure-management check should be performed first?

Security Information and Event Management: infrastructure management Medium
A. Change every detection rule immediately
B. Disable time synchronization on all devices
C. Delete older dashboards from the SIEM
D. Verify collector capacity and ingestion queues

30 An organization must support investigations for one year but control storage costs. Which retention strategy is most appropriate?

Security Information and Event Management: SIEM log retention strategies Medium
A. Keep every event in hot storage for one year
B. Use tiered storage with searchable recent logs and archived older logs
C. Delete all events after thirty days
D. Store only alerts and discard supporting events

31 A high-confidence alert shows a workstation communicating with a confirmed command-and-control address. Which automated response is most suitable when business disruption must be limited?

Security Information and Event Management: automated response and remediation Medium
A. Ignore the alert until a monthly review
B. Isolate the affected workstation from the network
C. Shut down the entire corporate network
D. Delete all user accounts on the workstation

32 A hunter searches for possible credential theft by examining unusual logins, new service creation, and access to credential stores. Why should these data sources be correlated?

Security Information and Event Management: threat hunting with SIEM Medium
A. Correlation removes the need for endpoint investigation
B. The sources are unrelated but increase dashboard size
C. Combined evidence can reveal related stages of an attack
D. Each source independently proves credential theft

33 A detection rule compares events from multiple systems but produces incorrect sequences because their clocks differ. Which operational requirement should be addressed?

Security Information and Event Management: operational requirements Medium
A. Longer usernames for administrators
B. More dashboard color choices
C. Uniform time synchronization across event sources
D. Higher screen resolution for analysts

34 A user normally accesses business applications during daytime hours but suddenly downloads a large volume of sensitive files at 2 a.m. UEBA should primarily treat this as:

Security Analytics and Machine Learning in SOC: behavioral analytics and UEBA Medium
A. A failed authentication requiring password reset
B. A deviation from the user's established behavior
C. A normal event because the account is valid
D. A guaranteed malicious action

35 A security model detects many true attacks but also generates a large number of false positives. Which evaluation concern is most directly involved?

Security Analytics and Machine Learning in SOC: ML-based security analytics Medium
A. The age of the operating system license
B. The balance between precision and recall
C. The physical size of the training servers
D. The number of dashboard widgets

36 Before deploying a predictive security model into production, which step best reduces operational risk?

Security Analytics and Machine Learning in SOC: deployment of predictive models Medium
A. Train it only on one analyst's favorite incidents
B. Test it on representative data and monitor performance
C. Disable logging so model decisions remain private
D. Deploy it directly with automatic account disabling

37 A network anomaly detector flags a server because outbound traffic is five times its normal baseline during a scheduled backup. What should the analyst do first?

Security Analytics and Machine Learning in SOC: anomaly detection in SOC Medium
A. Block all traffic from the server permanently
B. Classify the event as an attack without review
C. Confirm the activity against the backup schedule
D. Remove the server from anomaly monitoring

38 A correlation rule detects five failed logins followed by a successful login from a new country and an administrative action. Which additional field is most useful for reducing ambiguity?

Security Information and Event Management: fundamentals of SIEM Medium
A. The authenticated user's identity and source device
B. The total number of installed printers
C. The analyst's preferred report format
D. The SIEM dashboard's background color

39 Why should an automated SIEM playbook require approval before disabling a high-value service account when alert confidence is moderate?

Security Information and Event Management: automated response and remediation Medium
A. Approval helps limit business impact from false positives
B. Approval prevents analysts from reviewing evidence
C. Approval makes event timestamps unnecessary
D. Approval guarantees that the alert is malicious

40 A regional SIEM collector continues receiving logs during a temporary loss of connectivity to the central platform. Which design feature provides this resilience?

Security Information and Event Management: distributed processing Medium
A. Immediate deletion of unsent events
B. Dependence on a single central network path
C. Disabling collection during connectivity failures
D. Local buffering and store-and-forward processing

41 An EDR platform observes a signed office application spawning PowerShell, which launches an encoded command and accesses a credential database. The process is later deleted. Which detection approach is most resilient to the deletion of the executable?

Endpoint Analysis and Threat Hunting: endpoint detection and response Hard
A. Block every signed office application
B. Alert only when the deleted file is recovered
C. Correlate process ancestry, command-line behavior, and access patterns
D. Match the executable's SHA-256 hash

42 A sample performs no suspicious activity in an automated sandbox but is malicious in a victim environment. Which analysis strategy best tests for environment-aware evasion?

Endpoint Analysis and Threat Hunting: malware analysis and reverse engineering Hard
A. Increase the sandbox's disk capacity
B. Execute it repeatedly with the same sandbox profile
C. Vary timing, user activity, system artifacts, and network responses
D. Compare only the sample's static import table

43 An organization must prioritize remediation among four assets. Asset A has high exploitability but contains public data; Asset B has moderate exploitability and stores regulated customer records; Asset C has low exploitability and supports a critical production process; Asset D has high exploitability but is isolated and disposable. Which modeling principle should dominate prioritization?

Endpoint Analysis and Threat Hunting: data and asset-focused risk models Hard
A. Rank assets only by vulnerability severity
B. Rank assets by purchase price and replacement cost
C. Rank assets by the number of installed applications
D. Rank assets by expected business impact and exposure

44 A workstation requires local administrator privileges for a legacy application, and application replacement is not immediately possible. Which compensating control most directly limits the resulting endpoint risk?

Endpoint Analysis and Threat Hunting: principles of endpoint security Hard
A. Permit unrestricted outbound network access
B. Share one administrator account across support staff
C. Disable endpoint logging to reduce performance overhead
D. Allow elevation only for the approved application and task

45 A SIEM receives authentication events from systems using different time zones and inconsistent event schemas. Which capability is most important before reliable cross-source correlation?

Security Information and Event Management: fundamentals of SIEM Hard
A. Event normalization and time synchronization
B. Higher storage compression
C. Dashboard customization
D. Longer alert descriptions

46 A distributed SIEM uses regional collectors that continue receiving logs during a temporary loss of connectivity to the central analytics cluster. Which design property best prevents data loss and preserves later correlation?

Security Information and Event Management: distributed processing Hard
A. Independent regional dashboards without central indexing
B. Stateless forwarding with immediate deletion
C. Compression followed by sampling of high-volume events
D. Local buffering with durable queues and ordered replay

47 A hunter suspects that an attacker used a rare parent-child process relationship across thousands of endpoints. Which SIEM feature most directly accelerates investigation?

Security Information and Event Management: accelerated threat hunting Hard
A. Precomputed behavioral indexes and pivotable entity relationships
B. A dashboard showing only aggregate event counts
C. Manual export of every endpoint event
D. Full-text search over unindexed raw logs

48 A compliance report must demonstrate that privileged access reviews occurred monthly and that the underlying records were not altered. Which SIEM implementation best supports this requirement?

Security Information and Event Management: regulatory reporting with SIEM Hard
A. Retain alerts without their source authentication records
B. Use immutable evidence storage with time-stamped audit trails
C. Store only monthly review totals
D. Allow administrators to edit events after ingestion

49 A SIEM's ingestion rate is stable, but query latency increases sharply whenever a new log source is onboarded. Which infrastructure investigation is most appropriate first?

Security Information and Event Management: infrastructure management Hard
A. Measure ingestion, parsing, indexing, storage, and query resource contention
B. Disable correlation rules permanently
C. Replace all source systems with identical hardware
D. Increase alert severity thresholds

50 An organization needs rapid investigation for 30 days, searchable compliance evidence for one year, and low-cost preservation for seven years. Which retention architecture best fits these requirements?

Security Information and Event Management: SIEM log retention strategies Hard
A. Keep every event in hot storage for seven years
B. Delete raw events after alerts are generated
C. Use tiered retention with hot, warm, and immutable archival storage
D. Retain only normalized fields and discard source records

51 A SIEM detects a possible account takeover, but the account belongs to an emergency-response engineer. Which automation design best balances containment and operational risk?

Security Information and Event Management: automated response and remediation Hard
A. Require risk-based approval or step-up verification before disruptive action
B. Disable the account immediately for every matching alert
C. Automatically delete the account's recent authentication history
D. Ignore all alerts involving emergency-response accounts

52 A hunter finds a suspicious domain in DNS logs but cannot determine whether the activity was malicious. Which next pivot provides the strongest contextual enrichment?

Security Information and Event Management: threat hunting with SIEM Hard
A. Block the domain before collecting additional evidence
B. Search for the domain only in firewall deny logs
C. Correlate DNS requests with endpoint processes, users, and subsequent connections
D. Count how many times the domain appears in the dashboard

53 A SOC has frequent alert backlogs because rules generate duplicate alerts for the same incident across multiple sources. Which operational improvement most directly addresses the problem?

Security Information and Event Management: operational requirements Hard
A. Increase the number of unreviewed detection rules
B. Send every alert to all analysts simultaneously
C. Reduce the retention period for all security logs
D. Define deduplication, ownership, severity, escalation, and service-level procedures

54 A user normally accesses systems from one country during business hours but suddenly authenticates from another country using a new device and downloads an unusual volume of sensitive data. Why is UEBA more useful than a static allowlist in this case?

Security Analytics and Machine Learning in SOC: behavioral analytics and UEBA Hard
A. UEBA evaluates deviations across identity, device, time, location, and activity
B. UEBA detects only known malicious file hashes
C. UEBA replaces the need for authentication controls
D. UEBA approves every login from a previously observed country

55 A classifier achieves 99.5% accuracy on a test set where only 0.1% of events are malicious. Which conclusion is most defensible?

Security Analytics and Machine Learning in SOC: ML-based security analytics Hard
A. The model is operationally excellent
B. The test set proves the model has no false positives
C. Accuracy alone is insufficient; precision, recall, and class imbalance must be examined
D. The model has detected nearly all attacks

56 A predictive model was trained on historical data collected before a major cloud migration. After deployment, feature distributions shift substantially. What is the primary risk?

Security Analytics and Machine Learning in SOC: deployment of predictive models Hard
A. More storage guarantees higher recall
B. Concept or data drift can reduce model validity
C. Encryption automatically corrects the predictions
D. The model becomes deterministic and therefore more accurate

57 An unsupervised detector flags a large number of anomalies immediately after a company-wide shift to remote work. What is the best first response?

Security Analytics and Machine Learning in SOC: anomaly detection in SOC Hard
A. Disable all anomaly detection permanently
B. Validate the baseline against the operational change and retrain or segment it
C. Raise the threshold until no anomalies remain
D. Treat every anomaly as a confirmed incident

58 A privileged service account performs thousands of successful logins daily, making volume-based UEBA alerts noisy. Which refinement is most appropriate?

Security Analytics and Machine Learning in SOC: behavioral analytics and UEBA Hard
A. Model its expected peers, destinations, schedules, and authentication methods
B. Alert only when the account fails one password attempt
C. Exclude the service account from all monitoring
D. Apply the same baseline used for human employees

59 A SIEM distributes events by source region, but an attacker's activity spans two regions and the correlation rule runs independently in each partition. What architectural issue does this reveal?

Security Information and Event Management: distributed processing Hard
A. The archive tier is too inexpensive
B. The event fields are necessarily over-normalized
C. The collectors are using too much compression
D. The system lacks cross-partition state or global correlation

60 An automated playbook isolates an endpoint after detecting ransomware-like behavior. The endpoint may contain volatile evidence needed for investigation. Which playbook change is most appropriate?

Security Information and Event Management: automated response and remediation Hard
A. Power off every endpoint in the same network segment
B. Delete suspicious files before collecting metadata
C. Perform evidence-preserving collection before or during isolation
D. Suppress the event to avoid disrupting the user
Previous MCQ
Unit 2
Next MCQ
Unit 4