M4 C4.3.1 Deployment of SIEM Tool

What is the core function of a SIEM tool in a SOC?

• Customer service

• Real-time log analysis and alerting

• File encryption

• Database backups

What defines the overall functionality of SIEM in a SOC?

• Scope of Work

• Deployment script

• User interface

• Risk matrix

Which SIEM component is installed on each device to collect logs?

• Core

• Collector

• Agent

• Switch

What is the role of the SIEM collector?

• Display dashboards

• Encrypt emails

• Receive and normalize logs from agents

• Perform backups

Which component of SIEM performs correlation and data analysis?

• Switch

• Router

• Core

• Server

What kind of data does a SIEM agent filter before sending it to the collector?

• Random logs

• All data

• Pre-defined event logs

• User profiles

SIEM reports can be used for which of the following compliance activities?

• Cooking financial data

• Legal contracts

• IT audits

• Marketing plans

What is the output of SIEM related to the organisation’s security overview called?

• ISP rating

• Security posture

• Cyber index

• Log counter

Which of the following is NOT part of the SIEM scope for compliance?

• Logs and events

• Asset list

• Loan approvals

• Reporting latency

What is a use case in the context of SIEM deployment?

• A loan application

• A tax filing

• A procedural interface for devices

• A user complaint