2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A detection rule for 'lateral movement via SMB' is not firing. The rule checks `event_type == 'smb_connection'` and `destination_port == 445`. The analyst confirms that SMB events are being ingested and that a test event with the correct values does not trigger the rule. Which troubleshooting step is most likely to reveal the issue?

   • AInspect the raw SMB event to verify the exact field names and values.
   • BDisable and re-enable the rule to reset its internal state.
   • CIncrease the rule's priority to ensure it is evaluated before other rules.
   • DCheck the SIEM's overall ingestion rate to see if events are delayed.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst writes a detection rule to alert on suspicious PowerShell execution. The rule references the field `EventID` with value `4104` and `ScriptBlockText` containing `DownloadString`. Testing against a known malicious sample does not trigger the rule. The SIEM ingests Windows PowerShell operational logs, but the field is named `Script_Block_Text` in the normalized schema. What is the most likely cause?

   • AThe rule syntax is invalid because field names cannot contain underscores.
   • BThe EventID 4104 is incorrect; PowerShell uses EventID 400 for script block logging.
   • CThe field name `ScriptBlockText` does not match the normalized schema field `Script_Block_Text`.
   • DThe test sample did not actually execute PowerShell.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A detection rule is written for a SIEM that ingests Windows Event Logs. The rule references the field `EventID` and the value `4625`. The rule does not fire, even though failed logins are occurring. The analyst discovers that the SIEM uses a custom parser that maps the raw event's `Event ID` field to `Event_Id` in the normalized schema. What is the most efficient way to fix the rule?

   • ACreate a new rule using the raw field name `Event ID`.
   • BModify the SIEM parser to also populate `EventID`.
   • CUpdate the rule to reference the normalized field `Event_Id`.
   • DUse a regex to match both field names.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC uses a version-controlled repository for detection rules. A recent change to a rule intended to reduce false positives also caused it to stop detecting a known attack. The team needs to revert the change but preserve the ability to reapply the tuning later. What is the best approach?

   • ADisable the rule and rely on manual threat hunting.
   • BRevert the rule to the previous version in the repository, then create a separate branch for the tuning work.
   • CKeep the current rule and add a second rule with the old logic.
   • DDelete the current rule and recreate it manually from memory.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A detection rule that correlates events across a 24-hour window is causing the SIEM to run out of memory during scheduled searches. The rule is critical and must remain in place. What is the best way to reduce the memory footprint?

   • AIncrease the SIEM's memory allocation.
   • BShorten the correlation window to 1 hour.
   • CDisable the rule during peak hours.
   • DBreak the rule into multiple smaller searches that run more frequently and aggregate results.
   Reveal Solution Discussion Select an answer first