350-201 Question 132
Select 2An organization uses a SIEM tool to monitor and analyze security events across its network. The security team has noticed an increased number of failed login attempts on multiple servers and suspects an ongoing brute-force attack. Which of the following SIEM capabilities would be most useful in identifying and responding to this type of threat?
- A
Correlation of events from multiple sources
- B
Real-time alerting on suspicious activity
- C
Integration with endpoint protection tools
- D
Long-term data storage for forensic analysis
- E
Automated remediation of identified threats
Show answer and explanation
Correct answers: A, B
Explanation
SIEM tools are designed to collect, correlate, and analyze security data from multiple sources. In the case of a brute-force attack, the ability to correlate events (e.g., failed login attempts) across systems and provide real-time alerts enables rapid identification and response to the threat. Other features like long-term storage and endpoint integration are valuable for broader security operations but are less critical for detecting this specific attack pattern.
- A. Correct.
SIEMs excel at correlating events from multiple sources, such as failed logins across different servers, to identify patterns indicative of an attack. This is essential for detecting brute-force attempts.
- B. Correct.
Real-time alerting is a core functionality of SIEMs, allowing security teams to be promptly notified of suspicious activities like repeated failed login attempts, enabling quicker response.
- C. Incorrect.
While integration with endpoint protection tools can enhance response capabilities, it is not directly relevant to identifying or analyzing brute-force attacks through SIEM data.
- D. Incorrect.
Long-term data storage is valuable for forensic investigations but does not directly assist in the real-time detection of ongoing brute-force attacks.
- E. Incorrect.
Automated remediation is a useful feature in some security solutions, but it is not inherently a core or essential capability of SIEM tools for identifying brute-force attacks.