2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SIEM is experiencing high CPU usage because of a rule that performs a complex join across multiple event types over a 7-day window. The rule is critical but does not need to alert in real time. Which change best reduces performance impact while preserving the rule's detection capability?

   • ARemove the join and use a simple filter on a single event type.
   • BIncrease the rule's priority to ensure it runs first.
   • CShorten the time window to 1 day.
   • DReduce the evaluation frequency from every 5 minutes to every hour.
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   A detection rule in a SIEM references the field 'source_ip' to identify the source address of a network connection. However, the event schema for the network logs uses 'src_ip' instead. What is the most likely result of this field mismatch?

   • AThe rule will trigger on every event because the field is missing.
   • BThe rule will automatically map 'source_ip' to 'src_ip'.
   • CThe rule will cause a syntax error in the detection engine.
   • DThe rule will not trigger because the field does not exist in the event data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   A detection rule is intended to trigger when a user logs in from an IP address outside the corporate network AND the login occurs outside business hours. The rule currently uses the condition: (src_ip NOT IN corporate_networks) OR (hour NOT BETWEEN 9 AND 17). Why does the rule trigger more often than expected?

   • AThe rule should use XOR instead of OR to ensure exclusivity.
   • BThe NOT IN operator is incorrectly negating the source IP.
   • CThe BETWEEN operator is inclusive of the boundaries, causing extra triggers.
   • DThe OR operator should be AND to require both conditions.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A detection rule in a SIEM is written to alert on suspicious PowerShell activity. The rule references the field `EventID` with a value of `4104`. The rule never fires, even though PowerShell script block logging is enabled and events are being collected. What is the most likely issue?

   • AThe rule is using the wrong event ID; 4104 is for module logging, not script block logging.
   • BThe rule is missing the `source` field to specify the Windows Event Log.
   • CThe SIEM is not receiving PowerShell events because the agent is not installed.
   • DThe field name in the rule is `EventID`, but the actual event schema uses `Event_Id`.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A detection rule alerts when a single user downloads more than 500 MB in 1 hour. The rule is generating false positives for a backup application that legitimately transfers large amounts of data. The security team wants to reduce false positives without missing data exfiltration. The backup application uses a dedicated service account. What is the best adjustment?

   • ARemove the user aggregation and alert on any download over 500 MB.
   • BExtend the time window to 24 hours.
   • CAdd a condition to exclude the backup service account from the rule.
   • DIncrease the threshold to 2 GB per hour.
   Reveal Solution Discussion Select an answer first