2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst notices that a detection rule for 'successful brute-force login' never fires, even though the SOC has confirmed multiple successful logins after repeated failures. The rule uses the condition: `(failures > 5) and (success == true)`. The event schema logs failed and successful logins as separate event types. What is the most likely reason the rule does not trigger?

   • AThe threshold of 5 failures is too high for the observed traffic volume.
   • BThe rule needs a time window to correlate failures and successes over time.
   • CThe field names 'failures' and 'success' are mapped incorrectly in the rule.
   • DThe rule combines two conditions that cannot be true in the same event because failed and successful logins are separate events.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst modifies a detection rule to add a new field condition. After deploying the change, the rule stops generating alerts that previously fired. The team needs to understand what changed. Which action is most appropriate?

   • AReview the rule's version history to compare the previous and current logic.
   • BIncrease the rule's severity to make it more visible.
   • CDelete the rule and recreate it from scratch.
   • DCheck the SIEM's overall health and performance metrics.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   A detection rule is not triggering as expected. The analyst has verified that the rule syntax is correct and the fields are mapped correctly. What is the next logical step in the troubleshooting methodology?

   • ACheck the rule's logic and conditions to ensure they express the intended detection.
   • BDisable the rule and re-enable it.
   • CIncrease the rule's threshold to make it more sensitive.
   • DReboot the detection engine.
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   A detection rule performs a lookup against a large external threat intelligence feed for every event. The rule is causing delays in alert generation. What is the most effective way to reduce the performance impact?

   • AUse a less specific match condition to reduce the number of lookups.
   • BCache the threat intelligence feed locally and update it periodically.
   • CIncrease the timeout for the external lookup.
   • DRemove the threat intelligence lookup from the rule.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A junior analyst writes a detection rule with the following condition: `(source_ip == '10.0.0.0/8' and action == 'allow') or (destination_port == 443)`. The rule is intended to alert on allowed traffic from the internal 10.0.0.0/8 network to any destination. The rule triggers on traffic from external IPs to port 443, which is not intended. What is the flaw in the rule?

   • AThe action field should be checked before the source IP.
   • BThe source IP should be a single IP address, not a CIDR block.
   • CThe parentheses group the conditions incorrectly, causing the OR to apply to the entire expression.
   • DThe rule should use AND instead of OR for all conditions.
   Reveal Solution Discussion Select an answer first