312-39V2: Certified SOC Analyst v2

Question

A financial services company is deploying a SIEM solution to improve its cybersecurity posture. Despite implementing the SIEM, the security team finds that it does not detect known attacks or suspicious activity. Although the system produces reports, the team has difficulty interpreting them effectively. An investigation reveals that critical logs from firewalls, intrusion detection systems (IDS), and endpoint devices are not reaching the SIEM. What is causing the SIEM solution to fail to function as expected?

Explanation

A SIEM depends on receiving relevant log and event data from security controls and endpoints so it can normalize, correlate, and analyze that telemetry. If critical firewall, IDS, and endpoint logs are not being ingested, the deployment architecture or its configuration is incomplete or incorrect, leaving the SIEM without the evidence needed to detect attacks.

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ60

Community Discussion