Security Information and Event Management Quiz

What you'll be asked

1. What is the primary purpose of a SIEM system in a security operations center?
2. Which component of a SIEM architecture is responsible for receiving and processing raw data from log sources before it reaches the correlation engine?
3. In the context of SIEM, what does the process of 'normalization' involve?
4. Why is 'correlation' considered the most critical function of a SIEM?
5. An analyst notices that the SIEM is failing to trigger alerts for a known brute-force attack. After verifying that the logs are arriving at the SIEM, what is the most likely configuration issue?

Answers and explanations come after you submit.