You are working as a SOC analyst in a multinational company with multiple data centers and remote offices.
Security logs are stored locally at each site, making it difficult to correlate incidents across different locations.
Recently, an advanced persistent threat (APT) compromised multiple servers, but due to multiple sources of logs and inconsistent monitoring, the attack was detected only after significant data exfiltration. To improve visibility, streamline log analysis, and enable faster incident response, you need to implement a solution that aggregates logs from all sources into a unified system. Which solution will you implement?

• A. Local logging
• B. Distributed logging
• C. Event tracing
• D. Centralized logging

According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

• A. Create a Chain of Custody Document
• B. Set a Forensic lab
• C. CallOrganizational Disciplinary Team
• D. Send it to the nearby police station

You are a SOC analyst at a leading financial institution tasked with developing a comprehensive threat model to safeguard critical assets: sensitive customer data, online banking applications, and real-time payment processing systems. The organization has observed increased targeted attacks on financial entities, including credential theft, account takeovers, and sophisticated phishing. Senior management is concerned about long- term financial and reputational damage. You need intelligence providing insights into high-level risks, geopolitical threats, and emerging cybercriminal strategies with long-term implications for security posture.
Which type of threat intelligence are you seeking?

• A. Strategic threat intelligence
• B. Tactical threat intelligence
• C. Operational threat intelligence
• D. Technical threat intelligence

The SOC team at CyberSecure Corp is conducting a security review to identify anomalous log entries from firewall logs. The team needs to extract patterns such as email addresses, IP addresses, and URLs to detect unauthorized access attempts, phishing activities, and suspicious external communications. The SOC analyst applies various regular expressions (regex) patterns to filter and analyze logs efficiently. For example, they use \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b to match IPv4 addresses. Which regex pattern should the SOC analyst use to extract all hexadecimal color codes found in the logs?

• A. ([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})
• B. \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b
• C. (0[1-9]|1[0-2])/(0[1-9]|(1[0-2])/[0-9]|3[01])\d{4}
• D. [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}

A financial services company implements a SIEM solution to enhance cybersecurity. Despite deployment, it fails to detect known attacks or suspicious activities. Although reports are generated, the team struggles to interpret them. Investigation shows that critical logs from firewalls, IDS, and endpoint devices are not reaching the SIEM. What is the reason the SIEM is not functioning as expected?

• A. Difficulty handling the volume of collected log data
• B. Lack of understanding of SIEM features and capabilities
• C. Improper configuration or design of the SIEM deployment architecture
• D. Delays in log collection and analysis due to system performance issues