350-201 Question 131
Single answerA cybersecurity analyst at your organization is using a SIEM tool to detect potential threats within the network. The analyst notices a sudden spike in failed login attempts across multiple systems and decides to use the SIEM tool for further investigation. Which of the following functionalities of the SIEM tool would be most effective in identifying the root cause of this issue?
- A
Correlation of events from multiple sources to detect patterns
- B
Generating compliance reports for auditing purposes
- C
Threat intelligence integration to identify known attack signatures
- D
Automated remediation of detected incidents
Show answer and explanation
Correct answer: A
Explanation
The correct answer is 'Correlation of events from multiple sources to detect patterns' because SIEM tools are designed to collect and analyze data from multiple systems and sources. By correlating events, the analyst can uncover patterns, such as whether the failed logins are originating from the same IP address or targeting specific accounts, which is essential for identifying the root cause of the issue.
- A. Correct.
Correlation of events from multiple sources is a key functionality of SIEM tools that helps identify patterns and relationships across various logs and events. This would allow the analyst to determine if the failed logins are part of a coordinated attack, such as a brute force attempt.
- B. Incorrect.
Generating compliance reports is focused on meeting regulatory requirements and auditing, which is not directly useful for identifying the root cause of failed logins.
- C. Incorrect.
Threat intelligence integration is valuable for identifying known attack signatures, but in this scenario, the analyst needs to correlate the specific event of failed logins to uncover potential patterns or causes.
- D. Incorrect.
Automated remediation is a response measure and does not assist in the investigation process required to identify the root cause of the issue.