First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1SIEM and SOC Fundamentals
What is the primary purpose of a SIEM platform in a SOC?
- To replace endpoint antivirus agents with signature-based file scanning
- To collect and correlate logs centrally Correct answer.
- To store forensic disk images collected during an incident investigation
- To block malicious traffic at the network perimeter before it reaches any internal hosts
Explanation
A SIEM collects logs from many sources into a central platform and correlates them so that related events become alerts. Prevention, forensic image storage, and endpoint scanning are functions of other security controls.
Question 2SIEM and SOC Fundamentals
In a typical three-tier SOC, which task belongs to a Tier 1 analyst?
- Performing deep malware reverse engineering
- Triaging alerts and escalating confirmed incidents Correct answer.
- Designing new detection content from threat intelligence
- Leading the incident response engagement with legal counsel
Explanation
Tier 1 handles the first pass of alerts: validating, enriching, and escalating what looks real. Deep reverse engineering, detection authoring, and executive-level incident leadership sit with Tier 2, Tier 3, or management.
Question 3SIEM and SOC Fundamentals
Which term describes an alert that fires for activity that is actually benign?
- True positive
- False negative
- True negative
- False positive Correct answer.
Explanation
A false positive is an alert raised on activity that later proves to be legitimate. It is distinct from a false negative, which is malicious activity that produced no alert at all.
Question 4SIEM and SOC Fundamentals
What does the MITRE ATT&CK framework primarily document?
- Network protocols and their default port assignments
- Software vulnerabilities ranked by CVSS score
- Adversary tactics and techniques Correct answer.
- Compliance controls mapped to regulatory standards
Explanation
ATT&CK catalogues adversary tactics, which are their goals, and techniques, which are how they achieve those goals, based on observed behaviour. It is not a vulnerability list, a compliance mapping, or a protocol registry.
Question 5SIEM and SOC Fundamentals
Why does a SOC maintain playbooks for alert handling?
- To document the salary bands and career paths for each analyst tier
- To record the raw network packet captures required for legal hold
- To replace the need for any correlation searches in the SIEM
- To standardize investigation and response steps Correct answer.
Explanation
Playbooks encode the repeatable steps such as triage questions, enrichment, escalation points, and containment actions so any analyst handles a given alert type consistently. They complement detection logic rather than replacing it.
Question 6SIEM and SOC Fundamentals
Which activity best describes threat hunting?
- Proactively searching for undetected adversary activity Correct answer.
- Reviewing the daily dashboard of open ticket counts
- Blocking known-bad IP addresses at the firewall automatically
- Waiting for an alert to fire and then closing the ticket
Explanation
Threat hunting is hypothesis-driven, proactive searching through telemetry for activity that existing detections missed. It is distinct from reactive alert handling and from automated blocking.
Question 7SIEM and SOC Fundamentals
Which data source would you search to identify failed Windows logon attempts across a domain?
- DNS query logs
- NetFlow records
- Firewall session logs
- Windows Security event logs Correct answer.
Explanation
Authentication successes and failures on Windows hosts and domain controllers are written to the Security event log with specific logon event IDs. Firewall, DNS, and flow data record network activity, not authentication outcomes.
Question 8SIEM and SOC Fundamentals
What is the main function of a SOC?
- Developing the organization's software products securely
- Writing the organization's security policies
- Managing the patch cycle for all servers
- Detecting and responding to security incidents Correct answer.
Explanation
A SOC is the team and capability responsible for monitoring, detecting, and responding to security incidents around the clock. Secure development, patch management, and policy authorship sit with other functions.
Question 9SIEM and SOC Fundamentals
What does event normalization accomplish in a SIEM?
- It compresses raw logs to reduce storage costs across indexes
- It maps vendor-specific fields into a common schema Correct answer.
- It encrypts events in transit between forwarders and indexers
- It deletes duplicate events before they reach the indexer pipeline
Explanation
Normalization maps differing vendor field names and formats into a common schema so a single search can span multiple sources. Compression, encryption, and de-duplication are pipeline or storage concerns rather than normalization.
Question 10SIEM and SOC Fundamentals
In Splunk, what is the role of a data model?
- It enforces field-level masking of sensitive data at search time
- It defines role-based access controls for dashboards and alerts
- It schedules the automatic archiving of indexes to cold storage
- It provides a structured, accelerated view of events Correct answer.
Explanation
A data model organizes event data into a hierarchical structure of objects and fields, and it can be accelerated to make searches over that structure much faster. Access control, archiving, and field masking are separate features.
Question 11SIEM and SOC Fundamentals
In Splunk Enterprise Security, what is a notable event?
- A scheduled report emailed to the SOC manager each morning
- A configuration file that defines index retention settings
- A raw log line that failed parsing at index time
- An alert generated when a correlation search fires Correct answer.
Explanation
Notable events are the alert objects ES creates when the conditions of a correlation search are met, and they carry status, owner, urgency, and investigation context. Parse failures, scheduled reports, and index configurations are not notable events.
Question 12SIEM and SOC Fundamentals
Which Cyber Kill Chain phase describes an attacker establishing remote control of a compromised host?
- Exploitation
- Weaponization
- Command and Control Correct answer.
- Reconnaissance
Explanation
The Command and Control phase covers the attacker maintaining a communications channel to the compromised system for continued operation. Reconnaissance, weaponization, and exploitation all occur earlier in the chain.
Question 13SIEM and SOC Fundamentals
Which metric measures the average time from an event occurring to the SOC detecting it?
- Mean time to detect Correct answer.
- Mean time between failures
- Mean time to acknowledge
- Mean time to resolve
Explanation
Mean time to detect measures the elapsed interval between an event happening and its detection by monitoring. Resolution, failure intervals, and acknowledgement times measure different parts of the lifecycle.
Question 14SIEM and SOC Fundamentals
In Splunk, which statement distinguishes an index from a sourcetype?
- An index is where events are stored; a sourcetype labels the format of the data Correct answer.
- An index is a search-time filter; a sourcetype is a parsing rule applied at index time
- An index defines the field extractions; a sourcetype defines the retention period
- An index names the forwarder; a sourcetype names the receiving indexer
Explanation
An index is the repository where events are stored and searched, while a sourcetype identifies the data's format and drives its default parsing. Field extraction and retention are configured separately from both concepts.
Question 15SIEM and SOC Fundamentals
A correlation search generates hundreds of alerts per day for the same approved administrative script. What is the best first tuning step?
- Route every alert to Tier 3 for manual review
- Add an exclusion for the known-good script behavior Correct answer.
- Raise the alert severity so analysts notice it sooner
- Disable the search permanently and delete its history
Explanation
Known-good behaviour that repeatedly triggers a detection should be excluded so the alert stays meaningful and analysts retain trust in it. Disabling the search loses real coverage, and severity or routing changes do not remove the noise.
Question 16SIEM and SOC Fundamentals
When should a Tier 1 analyst escalate an alert rather than close it?
- When the activity is confirmed malicious or hits escalation criteria Correct answer.
- When the alert's configured severity has been set to informational by the content author
- When the alert has been open in the queue for more than five minutes without an owner
- When the analyst has never seen this particular alert type during their tenure
Explanation
Escalation happens when triage shows the activity is malicious or matches documented criteria such as involvement of a critical asset or data exposure. Queue age, analyst unfamiliarity, and informational severity are not escalation triggers on their own.
Question 17SIEM and SOC Fundamentals
What is the primary benefit of enriching alerts with threat intelligence?
- It removes the need for correlation searches in the detection pipeline
- It guarantees that every alert generated is a true positive
- It automatically remediates the affected host without analyst input
- It adds known-bad indicators to the context analysts review Correct answer.
Explanation
Threat intelligence supplies context such as known-bad IP addresses, domains, and file hashes that helps an analyst judge an alert quickly. It informs decisions but does not guarantee correctness, replace correlation, or perform remediation.
Question 18SIEM and SOC Fundamentals
Which telemetry is most useful for detecting DNS tunneling?
- Antivirus scan completion logs
- Server patch compliance reports
- DNS query and response logs Correct answer.
- Physical badge access logs
Explanation
DNS tunneling conceals data inside DNS queries and responses, so DNS logs reveal the anomalous query length, volume, and domain patterns. Antivirus, badge, and patch data contain no DNS traffic.
Question 19SIEM and SOC Fundamentals
Which situation describes a false negative?
- An analyst closes a ticket without documenting it
- An intrusion occurs but no alert is raised Correct answer.
- A duplicate alert is suppressed by a throttle
- A benign admin login is flagged as suspicious
Explanation
A false negative is malicious activity that no detection caught, meaning the SOC is blind to it. A benign event flagged as suspicious is a false positive, while documentation and throttling issues are process or configuration problems.
Question 20SIEM and SOC Fundamentals
What does user and entity behavior analytics (UEBA) contribute to a SOC?
- It enforces password complexity on directory accounts
- It provides packet-level reassembly of encrypted traffic
- It baselines normal behavior and flags anomalous activity Correct answer.
- It replaces log collection with agentless network scans
Explanation
UEBA learns a baseline of user and entity behaviour over time and surfaces deviations that static rules would miss, such as unusual access volume or timing. It does not manage credentials, replace log collection, or decrypt traffic.
Question 21SIEM and SOC Fundamentals
How does risk-based alerting change the way a SOC handles detections?
- Each detection adds risk to an entity rather than alerting separately Correct answer.
- Detections are suppressed until an analyst manually assigns a severity
- Each detection immediately pages the on-call analyst regardless of entity history
- Detections are ranked only by the raw event count observed in the index
Explanation
Risk-based alerting accumulates risk scores on users, hosts, and other entities as detections fire, and an alert is raised when the total crosses a threshold. This collapses many weak signals into fewer, better-contextualised alerts instead of one alert per detection.
Question 22SIEM and SOC Fundamentals
Two incidents have equal severity. Why might one be prioritized higher?
- It was detected by a more recently written correlation search
- It affects an asset with higher business criticality Correct answer.
- It was assigned to a more senior analyst
- It contains a larger number of raw events
Explanation
Priority combines technical severity with business context such as asset criticality, data sensitivity, and exposure. Rule recency, raw event volume, and analyst seniority do not determine business priority.
Question 23SIEM and SOC Fundamentals
Why is chain of custody important when handling evidence from a SOC investigation?
- It reduces the storage cost of retained log data over time
- It speeds up the correlation search runtime on large indexes
- It proves the SIEM license covers every affected host in scope
- It documents who handled evidence and when Correct answer.
Explanation
Chain of custody is a documented record of who handled evidence, when, and how, which supports its integrity and admissibility in disciplinary or legal proceedings. Licensing, storage cost, and search performance are unrelated concerns.
Question 24SIEM and SOC Fundamentals
In Splunk index lifecycle management, why are older buckets moved to cold storage?
- To increase the ingest throughput of the indexer cluster
- To reduce storage cost while keeping data searchable Correct answer.
- To satisfy the CIM acceleration requirements of data models
- To allow real-time searching of the newest events
Explanation
Cold buckets hold older data on cheaper storage while remaining searchable, balancing retention obligations against cost. Real-time search, ingest throughput, and data model acceleration are separate concerns.
Question 25SIEM and SOC Fundamentals
A SOC dashboard shows alert volume rising steadily while confirmed incidents stay flat. What is the most reasonable interpretation?
- The SIEM is no longer ingesting new data sources
- The SOC has eliminated all false positives successfully
- Detection noise is increasing and tuning is needed Correct answer.
- Analysts are closing tickets faster than before
Explanation
Rising alert volume with flat confirmed incidents means detections are producing more noise without producing more real findings, which signals a need for tuning or content review. The pattern should not be read as success, since success would show stable volume with maintained or improved confirmed detection.
Question 26SIEM and SOC Fundamentals
Which responsibility typically belongs to a Tier 1 analyst in a tiered SOC?
- Reverse engineering malware recovered from an endpoint
- Designing new detection logic and correlation searches
- Leading enterprise-wide incident response engagements
- Triaging and validating alerts from the queue Correct answer.
Explanation
Tiered SOCs separate monitoring from investigation and engineering. Tier 1 performs first-pass triage: validating alerts, gathering context, and either closing or escalating them. Deep analysis, detection authoring, and incident leadership sit at higher tiers.
Question 27SIEM and SOC Fundamentals
What is the primary purpose of the MITRE ATT&CK framework?
- Scoring the business criticality of every asset in the estate
- Cataloging adversary tactics and techniques from real attacks Correct answer.
- Defining statutory deadlines for notifying regulators of a breach
- Prescribing minimum firewall rule sets for perimeter segmentation
Explanation
ATT&CK is a knowledge base of adversary behavior organized into tactics (goals) and techniques (how the goal is achieved), derived from observed intrusions. Defenders use it to describe detections, assess coverage, and communicate about attacker behavior consistently.
Question 28SIEM and SOC Fundamentals
Which item is best described as an indicator of compromise?
- A quarterly vulnerability scan summary report
- A change request for a new backup appliance
- An approved exception to the password policy
- A file hash observed on hosts contacting a known C2 server Correct answer.
Explanation
An indicator of compromise is an observable artifact that suggests malicious activity, such as a malicious file hash, a known command-and-control address, or a suspicious registry key. Indicators are matched against telemetry to raise detections.
Question 29SIEM and SOC Fundamentals
Under the NIST incident response lifecycle, in which phase is malicious code removed from affected hosts?
- Containment, Eradication, and Recovery Correct answer.
- Post-Incident Activity, which covers lessons learned
- Preparation, which covers building tools and hardening systems
- Detection and Analysis, which covers scoping the intrusion
Explanation
Eradication is where the root cause, such as malware or an attacker foothold, is removed from the environment, and it forms a single phase with containment and recovery. Preparation builds capability beforehand, detection and analysis scopes the event, and post-incident activity captures improvements.
Question 30SIEM and SOC Fundamentals
Which Splunk component stores raw events and builds the indexes that searches read from?
- Universal forwarder
- License manager
- Indexer Correct answer.
- Deployment server
Explanation
Indexers receive data from forwarders, parse it, and write it to on-disk buckets that searches later query. Forwarders only collect and ship data, while the deployment server distributes configuration to forwarders.
Question 31SIEM and SOC Fundamentals
What does throttling a correlation search in Splunk Enterprise Security do?
- Disables the search automatically when the search head load is high
- Reduces the search's time range to the last 24 hours
- Prevents the search from writing results to the risk index
- Suppresses duplicate notables for the same condition in a window Correct answer.
Explanation
Throttling limits how often a correlation search can create a new notable event for the same condition, such as the same host and rule, within a configured time period. This controls duplicate alerting without changing what the search detects or when it runs.
Question 32SIEM and SOC Fundamentals
What is the primary purpose of a SOC runbook?
- To store raw log archives for regulatory retention periods
- To list every Splunk user account and assigned role
- To document investigation steps for a specific alert type Correct answer.
- To record the SOC's staffing roster and shift handover times
Explanation
A runbook gives analysts a repeatable procedure for a specific alert or scenario: what to check, which data to pull, when to escalate, and what to document. Consistent procedures reduce variance between analysts and speed up response.
Question 33SIEM and SOC Fundamentals
What is a honeytoken?
- A synthetic user account used only for load testing
- A duplicate copy of an index bucket retained in cold storage
- An encrypted tunnel used to ship logs to the indexer
- A decoy credential or file whose use signals intrusion Correct answer.
Explanation
Honeytokens are decoy artifacts, such as fake credentials, files, or records, that have no legitimate business use. Any access or use of them is high-fidelity evidence of unauthorized activity and typically generates a low-noise alert.
Question 34SIEM and SOC Fundamentals
According to the Pyramid of Pain, which indicator type costs an adversary the most to change?
- File hashes
- IP addresses
- Tactics, techniques, and procedures Correct answer.
- Domain names
Explanation
The Pyramid of Pain ranks indicators by how much operational disruption an adversary suffers when defenders detect and block them. Hashes, IPs, and domains are cheap to rotate, while TTPs sit at the top because changing established behavior is difficult and costly.
Question 35SIEM and SOC Fundamentals
Which type of threat intelligence is written for executives and focuses on actor trends and business risk?
- Operational intelligence
- Tactical intelligence
- Strategic intelligence Correct answer.
- Technical intelligence
Explanation
Strategic threat intelligence is produced for leadership and describes the threat landscape, actor motivations, and risk to the business in non-technical terms. Technical, tactical, and operational intelligence support defenders with indicators, adversary tooling, and campaign details.
Question 36SIEM and SOC Fundamentals
An alert fires every night at 02:00 because a sanctioned backup account runs its job. The detection logic matched the activity accurately. How should the analyst classify this?
- A benign true positive Correct answer.
- An inconclusive event
- A false negative
- A false positive
Explanation
Because the detection correctly identified the activity, it is a true positive; because the activity is authorized and expected, it is benign. Benign true positives usually indicate a tuning opportunity, such as excluding the backup account, rather than an incident to investigate.
Question 37SIEM and SOC Fundamentals
What does mean time to respond (MTTR) measure in a SOC?
- Average number of alerts handled per analyst per shift
- Average time between data ingestion and index availability
- Average time a correlation search takes to complete
- Average time between an alert and the incident being resolved Correct answer.
Explanation
MTTR tracks how long it takes from an alert or detection to resolution or containment of the incident. It reflects the efficiency of investigation and response processes after detection has already occurred.
Question 38SIEM and SOC Fundamentals
An analyst has opened a notable event in Incident Review and is actively investigating but has not contained the threat. Which status best reflects this?
- In Progress Correct answer.
- Resolved
- New
- Closed
Explanation
Notable status values track the investigation lifecycle: New means the event has not been triaged, In Progress means an analyst owns and is working it, and Resolved or Closed are terminal states recorded after the work is finished.
Question 39SIEM and SOC Fundamentals
Why does enriching notable events with ES asset and identity data improve triage?
- It encrypts notable event data at rest in the index
- It replaces correlation searches with asset-based detection
- It adds owner, business unit, and criticality context to the event Correct answer.
- It automatically closes notables for known assets
Explanation
Asset and identity lookups attach context such as the system owner, business unit, and asset criticality to each notable. Analysts can then prioritize events affecting high-value systems and contact the right people quickly.
Question 40SIEM and SOC Fundamentals
A critical-severity alert fires for a workstation that is confirmed powered off and offline for scheduled maintenance. What is the best assessment?
- The event should be closed as a false negative
- Severity is high but urgency is low, so defer it with a note Correct answer.
- The event should be escalated as a confirmed compromise
- The alert proves the detection logic is broken and should be deleted
Explanation
Severity describes potential impact, while urgency reflects how quickly action is needed given current context. An offline, maintained host cannot be actively compromised, so the event can be deferred and documented rather than escalated immediately.
Question 41SIEM and SOC Fundamentals
Why should a custom log source be mapped to the Splunk Common Information Model?
- It lets searches and dashboards use consistent field names Correct answer.
- It guarantees events arrive without delay from the forwarder
- It compresses events and reduces license consumption
- It removes the need to define a sourcetype for the data
Explanation
The CIM defines standardized field names, such as user, src, and dest, across many source types. Mapping custom data to those fields lets correlation searches, dashboards, and data models operate across heterogeneous sources without rewriting logic per vendor.
Question 42SIEM and SOC Fundamentals
A correlation search counts matching events within the last ten minutes. Which timestamp must be accurate for that window logic to be correct?
- The last-modified time of the source log file
- The time the search head dispatched the search
- The index time recorded when the event was written
- The parsed event time of each event Correct answer.
Explanation
Search time windows are evaluated against each event's parsed timestamp, which represents when the activity actually occurred. Index time reflects when Splunk received the data and can differ by minutes or hours when there is a collection delay.
Question 43SIEM and SOC Fundamentals
Which data source best supports detecting one internal host scanning many peers on TCP port 445?
- Windows Security event logs from the domain controller
- Network flow records such as NetFlow or IPFIX Correct answer.
- Web proxy logs for outbound HTTP requests
- Endpoint antivirus scan history
Explanation
Flow records capture connection attempts between hosts with source, destination, port, and byte counts, which makes fan-out scanning patterns visible. Domain controller logs cover authentication events, not internal port sweeps.
Question 44SIEM and SOC Fundamentals
A rule alerts when ten failed logins occur for one account within five minutes. Which detection method is this?
- Signature matching on file hashes
- Anomaly-based baselining
- Threshold-based time-window correlation Correct answer.
- Rule-based asset criticality scoring
Explanation
The rule counts occurrences of an event type over a defined time span and fires when the count crosses a fixed limit, which is threshold correlation. It depends on an explicit numeric condition rather than a learned baseline or a hash signature.
Question 45SIEM and SOC Fundamentals
A detection that normally fires several times a day suddenly produces no alerts, with no rule change. What should the analyst check first?
- Whether the underlying log source is still sending data Correct answer.
- Whether the index retention period was shortened
- Whether the search head needs a new license
- Whether analysts have been closing too many notables
Explanation
A sudden, silent drop in alerts from a stable rule most often means the telemetry feeding it has stopped or degraded. Confirming ingestion health before touching detection logic avoids chasing a rule problem that is actually a data pipeline problem.
Question 46SIEM and SOC Fundamentals
To cut alert volume, an analyst raises the threshold on a failed-logon rule from 5 to 50 attempts in 10 minutes. What is the most likely consequence?
- Both precision and recall improve because fewer alerts fire
- Recall drops and slow, distributed brute force attempts go undetected Correct answer.
- Precision drops and the rule fires more often on benign traffic
- Nothing changes because thresholds do not affect detection outcomes at all
Explanation
Raising a threshold makes the rule stricter, so fewer true malicious patterns satisfy it. Slow, low-volume attacks that never reach 50 attempts in ten minutes are missed, which reduces recall even though precision may improve.
Question 47SIEM and SOC Fundamentals
Using the Diamond Model, an analyst has a malicious IP and the malware hash found on one victim. Which pivot best helps identify the adversary's other operations?
- Calculating the entropy of the malware sample
- Searching for other victims with the same capability and infrastructure Correct answer.
- Checking the registrar creation date of the IP's domain
- Reviewing the victim's patch level and operating system version history
Explanation
The Diamond Model relates adversary, capability, infrastructure, and victim, and analysis advances by pivoting on known vertices. Because every intrusion using the same malware and infrastructure shares those vertices, hunting for other victims with the same pairing links related activity.
Question 48SIEM and SOC Fundamentals
Several endpoints fail to sync with NTP for a week. How does this most directly undermine correlation searches?
- Field extractions stop working on the affected endpoints and break CIM mapping
- Events are dropped by the indexer before being parsed
- Event times drift, so events miss correlation windows or reorder Correct answer.
- License usage spikes because timestamps are duplicated
Explanation
Correlation logic compares event timestamps against time windows and against each other to establish sequences. When clocks drift, events land outside the intended window or appear in the wrong order, so legitimate patterns fail to correlate.
Question 49SIEM and SOC Fundamentals
A SOC maps its detections to MITRE ATT&CK and finds large coverage gaps. What is the most useful way to act on that finding?
- Discard the mapping because ATT&CK is only for red teams
- Prioritize detections for techniques relevant to the org's threat profile Correct answer.
- Count techniques covered and report the percentage as the SOC's maturity score
- Attempt to implement at least one detection for every ATT&CK technique
Explanation
Coverage maps are prioritization tools, and techniques matter differently depending on the sector, assets, and actors targeting the organization. Weighting gaps by relevance directs detection engineering effort where it reduces the most realistic risk.
Question 50SIEM and SOC Fundamentals
A data model is accelerated, yet a search on raw fields not defined in the model runs slowly. Why?
- Acceleration only applies to the security app's default searches
- tstats can only report on fields defined in the accelerated data model Correct answer.
- The data model must be rebuilt after every search
- Accelerated data is stored unparsed and must be re-indexed for every search run
Explanation
Acceleration builds a summarized store of the fields defined in the data model, and tstats reads only from that store. Fields outside the model are not present there, so the search must fall back to raw event scanning and lose the performance benefit.