2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · medium

   A detection rule uses a complex regular expression that is applied to every network packet. The security team notices that the detection engine's CPU usage has increased significantly. What is the most likely cause?

   • AThe rule is using too much memory to store state.
   • BThe rule is causing network latency.
   • CThe rule's regular expression is computationally expensive and is evaluated on every packet.
   • DThe rule is triggering too often, causing excessive alert logging.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A detection rule alerts when more than 10 failed logins occur from a single source IP within 5 minutes. The rule is generating too many alerts because a legitimate application uses a single IP address for many users. The team wants to reduce false positives without missing distributed brute-force attacks. What is the best adjustment?

   • ARemove the source IP condition and alert on any failed login.
   • BIncrease the threshold to 50 failed logins.
   • CExtend the time window to 30 minutes.
   • DChange the aggregation to group by source IP and user account.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A security analyst has written a new detection rule and wants to validate that it triggers correctly without waiting for a real attack. What is the most efficient method to test the rule?

   • AAsk a colleague to manually review the rule logic.
   • BReview the rule's syntax with a linter.
   • CDeploy the rule to production and monitor for alerts.
   • DSubmit a test event that matches the rule's conditions to the detection engine.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   A detection rule is written for Windows Event Logs and references the field 'EventID' to detect a specific event. The actual event log contains the field 'Event ID' (with a space). What is the correct way to handle this field mapping?

   • AChange the rule to use the field 'EventID' and rely on the SIEM to normalize it.
   • BUse a regex to match the field name.
   • CUse a wildcard in the field name, such as 'Event*ID'.
   • DUse the field name 'Event ID' in the rule exactly as it appears in the log.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team uses a version control system to manage detection rules. A recent change to a rule caused an increase in false positives. The team wants to quickly revert to the previous version while preserving the ability to review what changed. What should you do?

   • AUse the version control system to revert the rule to the last known good commit.
   • BDelete the rule and recreate it from scratch.
   • CManually edit the rule back to the previous logic and save it.
   • DDisable the rule and create a new rule with the old logic.
   Reveal Solution Discussion Select an answer first