2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   A detection rule has been modified multiple times. The security team wants to understand what changes were made and when. What is the best practice to ensure this information is available?

   • AStore the rule in a database without versioning.
   • BUse a version control system to track rule changes.
   • CKeep a manual log of changes in a shared document.
   • DRely on the SIEM's built-in audit log.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A detection rule that performs a regex match on the full HTTP request body is causing high CPU usage on the SIEM search head. The rule is important but does not need to run in real time. What is the best way to reduce the performance impact?

   • ARun the rule only on weekdays during business hours.
   • BSchedule the rule to run less frequently, such as every 15 minutes instead of every minute.
   • CIncrease the timeout for the rule to allow it to complete.
   • DRemove the regex and use a simple substring match instead.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   A detection rule written in YAML for a SIEM platform fails to parse. The rule includes a field with a colon in the value, such as 'description: Alert: Suspicious activity'. What is the most likely syntax issue?

   • AThe rule must be written in JSON format instead of YAML.
   • BThe colon in the value must be escaped or the value must be quoted.
   • CThe field name 'description' is reserved and cannot be used.
   • DThe rule must use a tab character for indentation.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A detection rule is designed to alert when a user account is locked out more than 5 times in 10 minutes. The rule uses the condition `event_type: 'user_lockout'` and a threshold of `count > 5` over a 10-minute window. During testing, the rule fires when exactly 5 lockout events occur. What is the most likely cause?

   • AThe rule is counting all authentication events, not just lockouts.
   • BThe time window is set to 15 minutes instead of 10.
   • CThe threshold comparison uses `>=` instead of `>`.
   • DThe threshold is applied per source IP, not per user account.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A detection rule for 'new admin account creation' is not firing. The rule checks `event_type == 'user_create'` and `admin == true`. The analyst verifies that the SIEM receives the events and that a test event with both fields set to the expected values does not trigger the rule. What is the next logical troubleshooting step?

   • AInspect the raw event to confirm the actual field names and values.
   • BDisable and re-enable the rule to reset its state.
   • CIncrease the rule's priority to ensure it is evaluated first.
   • DRebuild the SIEM index to refresh the data.
   Reveal Solution Discussion Select an answer first