2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · medium

   A detection rule is written to alert when a process name is 'powershell.exe' AND the command line contains 'DownloadString'. The rule uses the condition: process_name == 'powershell.exe' AND command_line CONTAINS 'DownloadString'. However, the rule does not trigger for a known malicious event. Which change would most likely fix the rule?

   • AChange the equality operator to a regex match for the process name.
   • BRemove the process_name condition to simplify the rule.
   • CChange the AND to OR to broaden the detection.
   • DUse a case-insensitive match for the command line.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A detection rule for 'data exfiltration via DNS' uses the field `dns_query_length` and checks if it is greater than 100. The rule does not fire on known tunneling traffic. The SIEM's DNS logs use `query_length` for the length field. The analyst also notices that the rule uses `dns_query_name` for the domain, but the log uses `query`. What is the most likely cause?

   • AThe rule syntax is invalid because field names cannot contain underscores.
   • BThe threshold of 100 is too high for DNS tunneling.
   • CThe DNS logs are not being ingested into the SIEM.
   • DThe rule references field names that do not exist in the DNS event schema.
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   A detection rule triggers on any login failure event. The security team is overwhelmed by alerts from a single user who frequently mistypes their password. What is the most effective tuning adjustment to reduce false positives while still detecting brute-force attacks?

   • AReduce the timeframe to only consider failures within one minute.
   • BDisable the rule for that specific user.
   • CChange the rule to alert on successful logins instead.
   • DIncrease the threshold to require a higher number of failures within a short timeframe.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A rule alerts when a single user has more than 10 failed logins in 5 minutes. The SOC is seeing many alerts from a legacy application that retries authentication aggressively. The rule is meant to detect password spraying. Which tuning change best reduces false positives while preserving detection of password spraying?

   • AAdd a condition that the username must be an administrator.
   • BIncrease the failed login threshold to 50 in 5 minutes.
   • CChange the rule to alert when more than 10 distinct usernames have failed logins from the same source IP within 5 minutes.
   • DExtend the time window to 30 minutes.
   Reveal Solution Discussion Select an answer first
6. 10foundation · medium

   A security team updates a detection rule to fix a false positive issue. After deploying the update, they notice that the rule no longer triggers on a known malicious pattern. What is the most likely reason?

   • AThe rule was deployed to the wrong environment.
   • BThe rule's syntax is now invalid.
   • CThe update inadvertently changed the rule's logic or conditions.
   • DThe rule's version number was not incremented.
   Reveal Solution Discussion Select an answer first