CSA (312-39) SOC Simulation Lab

Welcome to the tier-3 SOC architecture module. In this lab, you will evaluate SIEM deployment strategies and determine the appropriate integration model when partnering with a Managed Security Services Provider (MSSP).

Scenario Context

You are acting as the Lead SOC Architect for a multinational financial institution. Due to strict data sovereignty laws and compliance mandates, all sensitive event correlation, analytics, and long-term log retention must be performed in-house on infrastructure owned by your organization.

However, your global network spans 400 branch offices generating massive volumes of raw edge telemetry (firewalls, proxies). To prevent your internal engineers from suffering burnout managing thousands of agent deployments and complex log parsing rules, you have contracted an external MSSP.

Security Environment

Review the recent Deployment Architecture Ticket outlining the division of responsibilities between your internal SOC team and the external vendor:

[ARCH-DEPLOYMENT-TICKET: #SOC-992] Subject: Splunk Heavy Forwarder & MSSP Integration Phase 2 Vendor Responsibilities (MSSP): - Deploy & manage edge collectors at global branch locations - Ingest raw telemetry (~75,000 EPS from firewalls, proxies, VPNs) - Perform log aggregation, filtering out low-value noise - Normalize data to Common Information Model (CIM) - Forward refined data to Internal SOC Core via TLS Internal SOC Responsibilities (On-Prem / Self-Hosted Core): - Manage on-prem Splunk Search Head Cluster (10.10.100.55) - Perform threat intel correlation (STIX/TAXII feeds) - Develop custom SPL detection analytics & visualization dashboards - Maintain 3-year cold storage retention for compliance audits - Execute L2/L3 Incident Response

Context: The organization retains full control over the "brains" of the SIEM (Analytics, Correlation, Retention) while outsourcing the heavy operational lifting of data ingestion (Collection, Aggregation) to the MSSP.

Question

Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP). What kind of SIEM is Robin planning to implement?

SOC Hint: The core analytics infrastructure resides with the organization (making it self-hosted), but the massive operational pipeline feeding it relies entirely on external management.

Expert Insight

1. What is happening

The SOC is implementing a split-responsibility architecture. Managing log collection at scale across a massive global enterprise is a brutal, resource-intensive task. By having the MSSP manage the collection and aggregation tier, the internal team avoids the "plumbing" work. The internal team then uses a self-hosted core SIEM instance to perform high-value detection engineering, threat hunting, and correlation.

2. Why the correct answer is correct

B. Self-hosted, MSSP Managed is correct. In EC-Council terminology for this scenario, because the central SIEM (where correlation, analytics, and retention happen) is hosted internally by the organization, it is Self-hosted. Because critical functional components of the SIEM pipeline—specifically collection and aggregation—are delegated to and operated by an external vendor, the overall deployment strategy incorporates an MSSP Managed operational overlay.

3. Why the other options are wrong

Self-hosted, Self-Managed (A): The organization would have to do everything themselves, including deploying edge collectors, writing syslog parsers, and managing aggregation at 400 branch offices.
Hybrid Model, Jointly Managed (C): While it sounds plausible, this typically refers to environments where the same SIEM instance is accessed and managed concurrently by both parties (e.g., MSSP does Tier 1 triage, Org does Tier 3 IR on the same dashboard).
Cloud, Self-Managed (D): Does not fit because there is no indication the infrastructure is hosted in a public cloud SaaS (like Azure Sentinel), and it ignores the MSSP's role entirely.

MINI LESSON: The SIEM Data Pipeline Lifecycle

As a senior analyst, you must understand that a SIEM is not just a dashboard; it is a complex data pipeline consisting of five distinct phases:

1. Collection: The hardest part. Gathering logs from Windows (WMI/WinRM), Linux (Syslog), Cloud (APIs), and Network appliances. (Outsourced to MSSP here).
2. Aggregation & Parsing: Structuring unstructured data, dropping noise, and formatting it to a Common Information Model (CIM) so rules work universally. (Outsourced to MSSP here).
3. Storage / Retention: Storing hot data for quick searches and cold data for compliance. (Done In-House).
4. Correlation & Analytics: The "brain." Matching rules against incoming structured data to detect anomalies or MITRE ATT&CK techniques. (Done In-House).
5. Alerting & Visualization: Notifying analysts via dashboards, SOAR integration, or ticketing systems. (Done In-House).

Ready to master more real-world SOC concepts?

Explore more CSA simulations