R7-IDR Practice Test

R7-IDR practice test: what's covered

• Log Search
• Detection Rules
• Investigations
• UBA
• Notable Events
• Automation

Free R7-IDR sample questions

1. A SIEM analyst notices no VPN authentications in InsightIDR since midnight even though users are connected. Which response is the BEST fit?

   • A. Check the event source health, collector connectivity, parsing status, and recent ingestion errors
   • B. Assume no VPN logons occurred and close related detections
   • C. Delete all VPN detection rules because they have no data
   • D. Change every user password before checking ingestion
   Show answer

   Correct: A. Check the event source health, collector connectivity, parsing status, and recent ingestion errors is the best answer because detections depend on healthy ingestion and parsed event sources. The other choices do not fit the scenario: Assume no VPN logons occurred and close related detections addresses the wrong layer or timing, Delete all VPN detection rules because they have no data skips a required control, and Change every user password before checking ingestion would create avoidable operational or security risk.

2. A firewall is sending syslog but fields are not appearing correctly in searches. Which response is the BEST fit?

   • A. Validate the event source type, parser mapping, timestamp, and sample raw logs
   • B. Create an investigation for every malformed event
   • C. Turn off syslog because parsing must be perfect immediately
   • D. Use only asset names because raw logs are irrelevant
   Show answer

   Correct: A. Validate the event source type, parser mapping, timestamp, and sample raw logs is the best answer because parser and source configuration determine how raw logs become searchable fields. The other choices do not fit the scenario: Create an investigation for every malformed event addresses the wrong layer or timing, Turn off syslog because parsing must be perfect immediately skips a required control, and Use only asset names because raw logs are irrelevant would create avoidable operational or security risk.

3. An endpoint agent and an Active Directory source both provide user context. Which response is the BEST fit?

   • A. Correlate endpoint and identity telemetry so investigations show both asset and user behavior
   • B. Keep identity logs outside the SIEM because endpoint logs are enough
   • C. Disable the endpoint agent when AD logs arrive
   • D. Use only DHCP leases to identify every user action
   Show answer

   Correct: A. Correlate endpoint and identity telemetry so investigations show both asset and user behavior is the best answer because InsightIDR value increases when endpoint, network, and identity sources are correlated. The other choices do not fit the scenario: Keep identity logs outside the SIEM because endpoint logs are enough addresses the wrong layer or timing, Disable the endpoint agent when AD logs arrive skips a required control, and Use only DHCP leases to identify every user action would create avoidable operational or security risk.

4. A company is onboarding a critical SaaS audit log source. Which TWO choices should the engineer select? (Choose TWO)

   • A. Confirm supported collection method and required API permissions
   • B. Verify sample events appear with expected timestamps and fields
   • C. Grant a global admin token with no expiration review
   • D. Skip validation because API configuration screens always prove ingestion
   Show answer

   Correct: A and B. Confirm supported collection method and required API permissions and Verify sample events appear with expected timestamps and fields are correct because API source onboarding needs permissions plus evidence that events are flowing and parsed. The distractors do not satisfy the requirement: Grant a global admin token with no expiration review is incomplete for this case, and Skip validation because API configuration screens always prove ingestion solves a different problem or weakens the design.

5. A log source sends timestamps in local time while the SIEM normalizes to UTC. Which response is the BEST fit?

   • A. Normalize timestamp handling and confirm searches use the correct time window
   • B. Ignore time zones because SIEM searches are date-only
   • C. Delete old logs so only new timezone data remains
   • D. Change analyst laptop time to match every source
   Show answer

   Correct: A. Normalize timestamp handling and confirm searches use the correct time window is the best answer because incorrect timestamp handling can hide or misorder events during investigation. The other choices do not fit the scenario: Ignore time zones because SIEM searches are date-only addresses the wrong layer or timing, Delete old logs so only new timezone data remains skips a required control, and Change analyst laptop time to match every source would create avoidable operational or security risk.

Last updated: 2026-09-23

R7-IDR practice test FAQ