KC-2 — Chapter 2 Knowledge Check
Questions and answer context for Chapter 2
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
1. What primary problem was SIEM technology designed to solve?
A. Antivirus deployment
B. Firewall management
C. Password management
D. Centralized collection and investigation of security telemetry
2. Which Wazuh component stores indexed security data?
A. Indexer
B. Agent
C. Dashboard
D. Decoder
3. Which component collects telemetry from monitored systems?
A. Dashboard
B. Indexer
C. Wazuh Agent
D. Decoder
4. Which process converts different vendor log formats into common searchable fields?
A. Encryption
B. Normalization
C. Compression
D. Replication
5. Correlation primarily helps analysts by:
A. Combining related events into meaningful investigations
B. Deleting duplicate logs
C. Encrypting telemetry
D. Reducing storage requirements
6. Which statement best describes a detection rule?
A. A Windows Event Log
B. A firewall policy
C. A malware signature database
D. Logic that evaluates events and determines whether an alert should be generated
7. Which component presents information to the analyst?
A. Manager
B. Dashboard
C. Agent
D. Decoder
8. Which statement represents good investigative practice?
A. Trust every alert immediately.
B. Begin with conclusions.
C. Collect evidence before reaching conclusions.
D. Investigate only the triggering event.
9. What should an analyst verify before beginning an investigation?
A. Windows Updates
B. Browser history
C. User passwords
D. Telemetry and monitoring infrastructure
10. Which of the following best describes SIEM maturity?
A. Continuous improvement of people, processes, and technology
B. Purchasing additional hardware
C. Installing more antivirus software
D. Increasing log retention
11. In Wazuh, what does a rule level of 0 indicate?
A. The most severe possible attack
B. A rule that matched but is intentionally ignored, generating no alert
C. A rule that failed to load
D. An event from a disconnected agent
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | D | SIEMs exist to centralize collection and investigation of telemetry. |
| 2 | A | The Indexer stores and indexes security data for search. |
| 3 | C | Agents collect and forward telemetry from monitored endpoints. |
| 4 | B | Normalization maps vendor formats into common fields. |
| 5 | A | Correlation combines related events into meaningful investigations. |
| 6 | D | A detection rule is logic that evaluates events and decides whether to alert. |
| 7 | B | The Dashboard is the analyst-facing interface. |
| 8 | C | Evidence precedes conclusions in professional investigations. |
| 9 | D | Verify telemetry and monitoring health before investigating. |
| 10 | A | Maturity is continuous improvement of people, processes, and technology. |
| 11 | B | Level 0 means the rule matched but is intentionally silenced—used to suppress known-benign activity. |