I85PREP
⌘ K
Exabeam Admin study materials
Exabeam Admin study resources

Exabeam Admin practice questions

One question at a time. Build your Exabeam Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In the Exabeam New-Scale platform, which component is responsible for ingesting and normalizing raw log data from collectors before correlation occurs?

  1. The Data Lake ingestion pipeline Correct answer.
  2. The correlation rule engine
  3. The threat intelligence feed
  4. The case management module

Explanation

New-Scale separates ingestion from analytics: raw events are received and normalized in the ingestion pipeline that feeds the Data Lake, where they become searchable and available to downstream detection. Correlation rules and case management operate on already-processed data rather than on raw collector output.

Question 2Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator is deploying the Exabeam New-Scale platform and must decide where correlation and analytics run relative to storage. Which statement describes the intended cloud-native architecture?

  1. Compute and storage scale independently, with stateless services reading from a shared data layer Correct answer.
  2. Analytics require a dedicated on-premises mainframe-class host
  3. Storage must be local to each correlation worker and cannot be shared
  4. All services must run on a single monolithic appliance node

Explanation

Cloud-native design decouples compute from storage so that ingestion, correlation, and search services can scale horizontally while reading from a shared data layer. This avoids tying data to individual nodes and supports elastic growth.

Question 3Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A security team wants Exabeam behavior analytics to baseline user activity across both on-premises Active Directory and cloud identity providers. What is the primary architectural requirement to achieve this?

  1. Each identity provider must run its own separate Exabeam instance
  2. Only endpoint antivirus logs need to be collected
  3. Identity and authentication events from all sources must be ingested and mapped to a common user identity Correct answer.
  4. Baselines must be built manually by analysts in spreadsheets

Explanation

User behavior analytics depend on a unified identity view, so authentication and activity events from every identity source must be ingested and normalized to a shared user identifier. Without that identity stitching, baselines fragment per source and anomalies are missed.

Question 4Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which Exabeam New-Scale capability allows an administrator to search raw and normalized events across long retention periods without provisioning a separate SIEM index tier?

  1. The local collector cache
  2. The playbook automation engine
  3. The alert triage queue
  4. The Data Lake with schema-on-read search Correct answer.

Explanation

The Data Lake stores events in a scalable repository queried with schema-on-read search, so long-retention investigations do not require a separately sized index tier. Collectors, triage queues, and playbooks serve different roles in the pipeline.

Question 5Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

When planning a LogRhythm SIEM deployment, which component is the central repository that stores normalized log data and hosts the majority of correlation processing?

  1. The Console
  2. The Alarming and Response Manager
  3. The System Monitor Agent
  4. The Data Processor Correct answer.

Explanation

In LogRhythm the Data Processor is the central server that receives logs from System Monitor Agents, stores normalized data, and performs most correlation and indexing work. The Console is the client interface and the Agent is the collection point.

Question 6Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A LogRhythm administrator needs to scale ingestion for a remote site with limited WAN bandwidth. Which deployment pattern best supports local collection with buffering before forwarding to the Data Processor?

  1. Send raw logs directly from devices over the WAN to the Console
  2. Deploy a System Monitor Agent or Log Relay at the site to collect and buffer locally Correct answer.
  3. Disable the site's logging until bandwidth improves
  4. Route all site traffic through the Alarming and Response Manager

Explanation

Placing an Agent or Log Relay near the source collects and buffers events locally, then forwards them efficiently to the Data Processor, which protects against WAN interruptions. Direct device-to-Console forwarding and disabling logging both break the collection model.

Question 7Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In LogRhythm, what is the role of a Log Source Virtualization or log source type definition during deployment?

  1. It encrypts the Data Processor's disk
  2. It assigns analyst case ownership
  3. It schedules automated report delivery
  4. It defines how a device's raw messages are parsed and normalized into LogRhythm's schema Correct answer.

Explanation

Log source type definitions supply the parsing rules that map raw device messages into the normalized schema used by rules and searches. Without a correct type, events arrive but are not meaningfully parsed.

Question 8Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An organization runs Exabeam New-Scale in a self-hosted model. Which consideration most directly affects capacity planning for correlation workloads?

  1. The color scheme of the analyst dashboard
  2. The number of browser tabs analysts keep open
  3. Events per second sustained and the number of active correlation rules Correct answer.
  4. The count of saved search names

Explanation

Correlation capacity is driven by sustained event throughput and the volume of rules evaluated against each event, since both determine compute load. Cosmetic or UI preferences have no bearing on backend capacity.

Question 9Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which statement best distinguishes the Exabeam New-Scale platform from a traditional self-hosted SIEM index architecture?

  1. New-Scale uses a cloud-native data lake with decoupled services rather than a fixed set of indexer appliances Correct answer.
  2. New-Scale stores no event data at all
  3. New-Scale requires every customer to run a single physical server
  4. New-Scale eliminates the need for any log collection component

Explanation

New-Scale is built as a cloud-native platform with a data lake and independently scalable services, in contrast to fixed indexer appliance clusters. It still stores events and still relies on collection components.

Question 10Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A LogRhythm deployment requires high availability for the Data Processor. Which approach reflects the supported design intent?

  1. Rely on agents to resend logs after an outage as the only HA mechanism
  2. Deploy a primary and secondary Data Processor pair with replication of the data store Correct answer.
  3. Install two Consoles and assume the data is shared automatically
  4. Place the Data Processor on a laptop for portability

Explanation

High availability for the Data Processor is achieved through a primary/secondary pair with replication so that processing and stored data survive a node failure. Consoles are clients and agent resend alone does not provide continuous processing.

Question 11Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which Exabeam component enriches ingested events with contextual information such as asset criticality and identity attributes to improve risk scoring?

  1. The context management and enrichment layer Correct answer.
  2. The raw collector buffer
  3. The report scheduler
  4. The password vault

Explanation

Risk scoring improves when events are joined with context like asset criticality and identity attributes, which the enrichment layer supplies. Buffers, schedulers, and vaults do not perform contextual enrichment.

Question 12Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator must onboard a new firewall vendor whose logs are not yet supported by a native parser in Exabeam New-Scale. What is the most appropriate first step?

  1. Convert the logs to PDF before ingestion
  2. Ingest the raw format and build or extend a parser mapping to the common information model Correct answer.
  3. Discard the logs until a native parser ships
  4. Send the logs to the case management module directly

Explanation

When no native parser exists, the standard approach is to ingest the raw format and create or extend a parser that maps fields to the common information model so the events are usable. Discarding or reformatting logs destroys their analytic value.

Question 13Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In LogRhythm, which component is primarily responsible for distributing alarms to email, syslog, or ticketing destinations based on configured rules?

  1. The Data Indexer
  2. The Log Source Manager
  3. The Alarming and Response Manager Correct answer.
  4. The System Monitor Agent

Explanation

The Alarming and Response Manager evaluates alarm conditions and dispatches notifications to configured destinations such as email, syslog, or ticketing systems. Agents collect logs, indexers store data, and log source management handles parsing definitions.

Question 14Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A team is evaluating whether to run Exabeam New-Scale as a cloud-hosted service or self-hosted. Which factor most directly favors the cloud-hosted option?

  1. The organization requires air-gapped network isolation
  2. The organization wants to supply its own server hardware
  3. The organization needs to control the physical rack layout
  4. The organization wants the vendor to manage scaling and platform upgrades Correct answer.

Explanation

Cloud-hosted delivery shifts scaling and upgrade responsibility to the vendor, reducing operational burden. Physical rack control, air-gapped isolation, and hardware sourcing are reasons to choose self-hosted instead.

Question 15Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which LogRhythm component acts as the client interface where analysts view alarms, run investigations, and administer the platform?

  1. The Log Relay
  2. The Console Correct answer.
  3. The Data Processor
  4. The System Monitor Agent

Explanation

The Console is the thick-client interface used for administration, alarm review, and investigation. The Data Processor is the server, while Agents and Relays handle collection and forwarding.

Question 16Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator observes that events from a newly added LogRhythm log source appear in the console but generate no correlation alarms. Which area should be checked first?

  1. Whether the log source is assigned the correct log source type and is enabled for processing Correct answer.
  2. Whether the analyst's password meets complexity rules
  3. Whether the report scheduler is paused
  4. Whether the Console monitor resolution is set correctly

Explanation

Events that arrive but never trigger alarms usually indicate a parsing or processing problem, such as a wrong log source type or a disabled processing flag. Password policy, reporting, and display settings do not affect correlation.

Question 17Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In Exabeam New-Scale, what is the purpose of the common information model applied during ingestion?

  1. To encrypt data at rest
  2. To assign analyst shift schedules
  3. To define the platform's licensing tiers
  4. To map vendor-specific fields into consistent normalized fields used by detection and search Correct answer.

Explanation

The common information model normalizes vendor-specific field names and formats into consistent fields so that detection rules and searches work uniformly across sources. It does not handle encryption, scheduling, or licensing.

Question 18Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which deployment practice best supports network segmentation requirements when collecting logs from a protected enclave into Exabeam New-Scale?

  1. Allow direct internet access from every endpoint to the platform
  2. Place a collection component inside the enclave that forwards outbound to the platform Correct answer.
  3. Disable firewalls within the enclave
  4. Open all inbound ports from the platform into the enclave

Explanation

A collection component inside the enclave can initiate outbound connections to the platform, which satisfies segmentation by avoiding inbound holes into the protected zone. Opening inbound ports broadly or disabling firewalls undermines the segmentation requirement.

Question 19Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A LogRhythm administrator wants to reduce WAN traffic by aggregating logs from many devices at a branch before forwarding. Which component is designed for this?

  1. A Log Relay Correct answer.
  2. The Data Indexer
  3. The Alarming and Response Manager
  4. The Console

Explanation

A Log Relay aggregates and forwards logs from multiple sources, reducing the number of WAN connections and centralizing transport. The other components handle alarming, administration, and indexing rather than aggregation.

Question 20Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which statement accurately describes how Exabeam New-Scale handles retention compared with a fixed-size self-hosted index?

  1. Retention is fixed at seven days and cannot be changed
  2. Retention is controlled only by the analyst's browser cache
  3. Retention is a policy applied to data in the data lake, allowing longer history without resizing appliance clusters Correct answer.
  4. Retention requires deleting all parsers each month

Explanation

Because New-Scale stores data in a scalable data lake, retention is governed by policy rather than by the physical capacity of a fixed indexer cluster. This allows longer historical search without appliance resizing.

Question 21Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

During a LogRhythm deployment, which prerequisite most affects the ability of the Data Processor to receive logs from agents across a firewall?

  1. The Console must be installed on the same subnet as every agent
  2. All agents must share one hostname
  3. The correct service ports must be permitted between agents and the Data Processor Correct answer.
  4. The Data Processor must run on a domain controller

Explanation

Agents must be able to reach the Data Processor over the required service ports, so firewall rules permitting that traffic are a core prerequisite. Console placement, hostname sharing, and domain controller roles are not requirements.

Question 22Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An organization wants Exabeam analytics to detect anomalies in privileged account usage. Which data source combination is most essential to that goal?

  1. Printer queue logs and DHCP lease logs only
  2. Privileged access management and directory authentication logs correlated with activity logs Correct answer.
  3. Web proxy cache logs only
  4. Physical badge reader logs only

Explanation

Privileged account anomaly detection requires authentication events from PAM and directory systems joined with the activity those accounts perform. Peripheral sources like printers, proxies, or badge readers alone cannot establish privileged behavior baselines.

Question 23Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which Exabeam New-Scale characteristic most directly supports multi-tenant separation for a managed security service provider?

  1. Disabling correlation for all but one tenant
  2. Sharing a single administrator account across all tenants
  3. Requiring one physical server per tenant
  4. Logical separation of tenant data and configuration within a shared platform Correct answer.

Explanation

A cloud-native platform can provide logical tenant isolation of data and configuration on shared infrastructure, which is what an MSSP needs. Physical servers per tenant, shared admin accounts, and disabled correlation all undermine secure multi-tenancy.

Question 24Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In LogRhythm, which best describes the function of the Data Indexer in a distributed deployment?

  1. It sends alarm emails to recipients
  2. It provides the analyst graphical interface
  3. It stores and indexes processed data to support fast searching and reporting Correct answer.
  4. It collects raw logs from endpoints

Explanation

The Data Indexer stores and indexes processed data so that searches and reports return quickly across large volumes. Collection, interface, and notification duties belong to other components.

Question 25Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A customer must keep all telemetry within their own data center for regulatory reasons but still wants Exabeam analytics. Which deployment choice fits?

  1. A hybrid model that ships raw logs offshore
  2. Self-hosted Exabeam deployment within the customer's data center Correct answer.
  3. Cloud-hosted deployment in a vendor region
  4. A public SaaS trial environment

Explanation

Data residency requirements that forbid telemetry leaving the customer data center point to a self-hosted deployment inside that facility. Cloud-hosted, offshore-shipping, and public trial options all move data outside the required boundary.

Question 26Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In an Exabeam New-Scale deployment, which component is responsible for ingesting and normalizing raw log data before it is stored for analytics?

  1. The correlation rule engine
  2. The case management module
  3. The Data Lake ingestion pipeline Correct answer.
  4. The threat intelligence feed

Explanation

New-Scale ingests raw telemetry through a pipeline that parses and normalizes events into the common information model before persisting them in the data lake. Analytics, correlation, and case workflows consume that normalized data downstream rather than performing the initial ingestion themselves.

Question 27Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A LogRhythm administrator is designing a distributed deployment and needs to know where parsed, normalized log data is written for long-term search and reporting. Which component fulfills that role?

  1. The Alarming and Response Manager
  2. The System Monitor Agent
  3. The Data Indexer Correct answer.
  4. The Platform Manager

Explanation

In a distributed LogRhythm deployment the Data Indexer stores processed log data and serves searches and reports against it. Data Processors parse and normalize events, then forward them to the indexer for retention and retrieval.

Question 28Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An organization is planning a self-hosted Exabeam New-Scale deployment and must size storage for the data lake. Which input most directly drives that sizing decision?

  1. The frequency of threat intelligence feed updates
  2. The count of correlation rules enabled at go-live
  3. The number of analyst accounts licensed for the console
  4. Sustained daily ingest volume combined with the required retention period Correct answer.

Explanation

Data lake capacity is a function of how much data arrives each day multiplied by how long it must be retained, plus overhead for replicas and growth. Licensing counts, rule counts, and feed refresh cadence do not materially change stored bytes.

Question 29Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which statement best describes how Exabeam New-Scale differs from a legacy SIEM that relies on fixed-size index partitions?

  1. It separates scalable storage of normalized events from compute used for analytics and detection Correct answer.
  2. It replaces detection logic entirely with static signature matching
  3. It requires every customer to host all components inside a single physical appliance
  4. It eliminates the need for any log normalization by storing raw text only

Explanation

New-Scale decouples storage from compute so that retention and analytic capacity can scale independently. Events are still normalized into a common model, and detection combines behavioral analytics with rules rather than relying on signatures alone.

Question 30Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator must forward LogRhythm alarms to an external ticketing system and to email recipients. Which component should be configured to accomplish this?

  1. The Data Indexer
  2. The Log Source Virtualization layer
  3. The Alarming and Response Manager Correct answer.
  4. The System Monitor Agent

Explanation

The Alarming and Response Manager evaluates alarm conditions and dispatches notifications to email, syslog, SNMP, or ticketing integrations. Indexers store data and agents collect it, so neither handles outbound alarm delivery.

Question 31Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

During a LogRhythm deployment, a Data Processor cannot receive logs from several network devices even though the agents are healthy. Which prerequisite most commonly explains this failure?

  1. The Data Indexer has too many free disk blocks
  2. The console has too many saved search filters
  3. The Platform Manager clock is set to a different time zone
  4. Required listening ports are blocked between the devices and the Data Processor Correct answer.

Explanation

Log delivery depends on the collection ports being reachable through every firewall and ACL between the source and the Data Processor. Disk space, saved filters, and time zone settings do not prevent TCP or UDP delivery of events.

Question 32Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A security team wants Exabeam analytics to baseline privileged account behavior across both directory and endpoint activity. Which data source pairing best supports that goal?

  1. Domain controller authentication logs combined with endpoint privilege escalation events Correct answer.
  2. Wireless controller association logs combined with DHCP leases
  3. Firewall deny logs combined with DNS query logs
  4. Web proxy URL logs combined with antivirus scan summaries

Explanation

Privileged account baselining needs identity authentication context from directory services plus evidence of privilege use on endpoints. Together they let the platform model normal logon patterns and flag anomalous escalation.

Question 33Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A managed security service provider needs strict separation between customer tenants on Exabeam New-Scale. Which platform characteristic most directly supports that requirement?

  1. Logical tenant isolation applied to data, users, and detection content Correct answer.
  2. A single shared administrator account across all customers
  3. One global retention policy applied uniformly to every tenant
  4. Disabling role-based access control to simplify onboarding

Explanation

Multi-tenant separation depends on isolating each customer's data, user population, and detection content so that one tenant cannot view another's telemetry. Shared credentials, uniform retention, and disabled RBAC all undermine that boundary.

Question 34Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator is deploying a LogRhythm System Monitor Agent on a remote host that must forward logs to a Data Processor. Which configuration element determines where the agent sends its collected events?

  1. The log source type selected in the parsing library
  2. The retention period set on the Data Indexer
  3. The alarm notification template assigned in the console
  4. The Data Processor address configured in the agent's collection settings Correct answer.

Explanation

Each agent is pointed at a specific Data Processor that receives its forwarded events, so the configured processor address controls delivery. Retention, notification templates, and parser selection affect downstream processing rather than the forwarding destination.

Question 35Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

In Exabeam New-Scale, what is the primary purpose of mapping incoming events to a common information model during ingestion?

  1. To give heterogeneous vendor logs consistent field names that analytics and rules can query uniformly Correct answer.
  2. To compress event payloads so that storage costs are reduced
  3. To encrypt events in transit between collectors and storage
  4. To assign each event a fixed retention period based on vendor

Explanation

The common information model normalizes vendor-specific field names into a consistent schema so that detections, searches, and models work across sources. Compression, transport encryption, and retention assignment are separate concerns handled elsewhere in the pipeline.

Question 36Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A regulated customer must retain all telemetry inside its own data center while still using Exabeam behavioral analytics. Which deployment model satisfies that constraint?

  1. A hybrid model that stores raw logs on premises but ships all normalized events to the cloud
  2. Cloud-hosted New-Scale in the vendor's region of choice
  3. Self-hosted New-Scale deployed within the customer's own infrastructure Correct answer.
  4. A standalone log collector with no analytics tier

Explanation

Only a self-hosted deployment keeps all telemetry, including normalized data used by analytics, inside the customer's own environment. Cloud and hybrid options move data off premises, and a collector alone provides no behavioral analytics.

Question 37Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

A LogRhythm administrator wants a branch office to send logs from many local devices to the core over a single WAN path. Which design element accomplishes this aggregation?

  1. A duplicate console server running at the branch for analysts
  2. A second Platform Manager installed at the branch for redundancy
  3. An additional Data Indexer deployed at the branch for search
  4. A Data Processor or collection point placed at the branch to consolidate local sources Correct answer.

Explanation

Placing a collection or processing point at the branch lets local devices forward to a nearby node that consolidates traffic over one WAN link. Platform Managers, indexers, and consoles serve management, storage, and user access rather than local log consolidation.

Question 38Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An administrator is choosing between a cloud-hosted and a self-hosted Exabeam New-Scale deployment. Which factor most directly determines whether self-hosting is viable?

  1. Whether the organization has more than one threat intelligence subscription
  2. Whether analysts prefer a dark or light console theme
  3. Whether the organization can supply and operate the required compute, storage, and lifecycle management Correct answer.
  4. Whether the SOC operates on a follow-the-sun staffing model

Explanation

Self-hosting shifts responsibility for infrastructure provisioning, scaling, patching, and upgrades onto the customer, so operational capability is the decisive factor. UI preferences, feed subscriptions, and staffing models do not determine deployment viability.

Question 39Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

Which LogRhythm component provides the graphical client where analysts review alarms, run investigations, and perform administrative tasks?

  1. The Data Indexer
  2. The System Monitor Agent
  3. The Data Processor
  4. The Client Console Correct answer.

Explanation

The Client Console is the analyst and administrator interface for alarms, investigations, and configuration. Processors, agents, and indexers are backend roles concerned with collection, parsing, and storage.

Question 40Platform Deployment and Architecture (New-Scale Platform, LogRhythm SIEM, Cloud-Native and Self-Hosted)

An organization must collect logs from a protected enclave that forbids direct inbound connections from the core SIEM. Which deployment practice best satisfies that constraint?

  1. Deploy a collection agent or forwarder inside the enclave that initiates outbound connections to the core Correct answer.
  2. Replicate the Data Indexer inside the enclave and search it manually
  3. Enable a direct console-to-device connection over the internet
  4. Open inbound firewall rules from the core to every device in the enclave

Explanation

An agent or forwarder inside the enclave can establish outbound sessions to the core, so no inbound path into the protected segment is required. Opening inbound rules, direct internet console access, and manual indexer replication all violate the segmentation intent.

Question 41Log Ingestion, Data Pipeline Management, and Log Management

In Exabeam, which component is primarily responsible for receiving raw event data from forwarders and syslog sources before it is parsed and enriched?

  1. The Threat Detection model store
  2. The Case Management module
  3. The Data Lake ingestion service Correct answer.
  4. The Correlation Rule engine

Explanation

Raw events arrive at the ingestion layer, which accepts data from forwarders and syslog feeds and stages it for parsing and enrichment before storage. Correlation rules and detection models operate on normalized data downstream, and case management is an analyst workflow layer.

Question 42Log Ingestion, Data Pipeline Management, and Log Management

An administrator wants Exabeam to accept syslog events over TCP on port 514 from a network device. Which configuration element must be defined so the listener knows how to interpret and route those messages?

  1. A parser and destination mapping tied to the listener Correct answer.
  2. A watchlist containing the device hostname
  3. A correlation rule scoped to the device IP
  4. A risk score threshold for the source zone

Explanation

A syslog listener needs an associated parser to structure the raw message and a destination that determines where parsed events are routed. Correlation rules, watchlists, and risk thresholds act on data after it has been ingested and normalized.

Question 43Log Ingestion, Data Pipeline Management, and Log Management

What is the primary purpose of a log parser in the Exabeam pipeline?

  1. To transform raw log text into structured fields for normalization Correct answer.
  2. To throttle forwarder bandwidth during peak hours
  3. To assign analysts to open cases automatically
  4. To encrypt events at rest in the data lake

Explanation

Parsers extract structured key-value fields from raw log text so that downstream normalization can map them to a common schema. Encryption, case assignment, and bandwidth throttling are handled by other subsystems entirely.

Question 44Log Ingestion, Data Pipeline Management, and Log Management

A vendor changes its log format, and events from that source now appear in Exabeam with the wrong activity type. Which pipeline stage should the administrator inspect first?

  1. The data lake retention policy
  2. The forwarder heartbeat interval
  3. The normalization mapping for that parser Correct answer.
  4. The user risk score model weights

Explanation

Normalization maps parsed fields to canonical event attributes such as activity type, so a vendor format change typically requires updating that mapping. Retention, heartbeat, and risk model settings do not determine how fields are classified.

Question 45Log Ingestion, Data Pipeline Management, and Log Management

Which Exabeam capability lets an administrator validate that a newly onboarded log source is producing events end to end?

  1. The rule exclusion list
  2. The case template designer
  3. The health and monitoring view for the data source Correct answer.
  4. The watchlist editor

Explanation

Health and monitoring views show whether a configured source is actively delivering events, which confirms end-to-end ingestion. Watchlists, case templates, and exclusion lists modify behavior but do not verify data flow.

Question 46Log Ingestion, Data Pipeline Management, and Log Management

An administrator configures a new log source but no events appear. The forwarder shows a healthy connection, yet the Exabeam listener reports zero messages. Which troubleshooting step is most appropriate?

  1. Increase the data lake retention window
  2. Verify the source is sending to the correct listener port and protocol Correct answer.
  3. Regenerate the analyst watchlists
  4. Rebuild all correlation rules for the tenant

Explanation

A healthy forwarder connection does not guarantee messages reach the intended listener, so confirming port and protocol alignment is the direct next step. Rule rebuilds, retention changes, and watchlist regeneration do not address missing delivery.

Question 47Log Ingestion, Data Pipeline Management, and Log Management

What does the Exabeam data lake primarily provide for log management?

  1. Automated firewall policy enforcement
  2. Endpoint antivirus signature distribution
  3. Long-term storage and search of normalized and raw event data Correct answer.
  4. Real-time packet capture of network traffic

Explanation

The data lake stores ingested events for long-term retention and supports search and analytics across that data. Packet capture, firewall enforcement, and antivirus distribution are functions of other security tools.

Question 48Log Ingestion, Data Pipeline Management, and Log Management

An administrator needs to reduce storage consumption from a high-volume, low-value log source while preserving the ability to search recent events. Which approach best fits Exabeam log management?

  1. Delete the forwarder configuration entirely
  2. Apply a shorter retention period to that source's data Correct answer.
  3. Disable normalization for all sources in the tenant
  4. Remove the parser and store raw text only

Explanation

Retention policies can be scoped so lower-value sources age out sooner while recent data remains searchable. Disabling normalization tenant-wide or removing parsing degrades analytics, and deleting the forwarder stops ingestion altogether.

Question 49Log Ingestion, Data Pipeline Management, and Log Management

Which statement accurately describes the relationship between parsing and normalization in the Exabeam pipeline?

  1. Parsing and normalization are performed by the same correlation rule
  2. Normalization occurs before raw events reach the parser
  3. Parsing extracts fields, and normalization maps them to a common schema Correct answer.
  4. Normalization extracts fields, and parsing maps them to a common schema

Explanation

Parsing is the extraction step that turns raw text into fields, and normalization then maps those fields into the common schema used for analytics. The order is fixed, so normalization cannot precede parsing.

Question 50Log Ingestion, Data Pipeline Management, and Log Management

A security team wants Exabeam to enrich incoming events with asset criticality from an external inventory. Which mechanism is designed for this kind of contextual enrichment?

  1. Context tables populated from the external source Correct answer.
  2. Data lake compression settings
  3. Correlation rule time windows
  4. Forwarder buffer sizing

Explanation

Context tables supply reference data such as asset criticality that can be joined to events during processing. Rule windows, compression, and buffer sizing affect timing or storage, not enrichment content.