2.24 Troubleshoot Existing Detection Rules 350-201 Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A detection rule that correlates login failures across multiple accounts using a 24-hour sliding window is causing significant CPU load on the SIEM. The rule is important but does not need to run in real time. Which change best reduces performance impact while maintaining detection capability?

   • AIncrease the evaluation interval from every minute to every 15 minutes.
   • BUse a larger window of 48 hours to capture more events.
   • CRemove the time window and alert on any single failed login.
   • DDisable the rule during peak hours.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst has written a new detection rule for a SIEM. Before deploying it to production, the analyst wants to validate that the rule triggers correctly on known malicious activity and does not trigger on normal traffic. What is the best approach?

   • AReview the rule syntax and logic manually to ensure it is correct.
   • BRun the rule against a test dataset that includes both known malicious samples and benign traffic.
   • CDeploy the rule in production and monitor for alerts over the next week.
   • DCompare the rule to similar rules from other organizations.
   Reveal Solution Discussion Select an answer first
3. 33foundation · medium

   A detection rule is generating too many false positives. The analyst has already reviewed the rule logic and confirmed it is correct. What is the next best step to troubleshoot the issue?

   • AImmediately increase the threshold to reduce alerts.
   • BEnable detailed logging for the rule to see which events are triggering it.
   • CIgnore the false positives and move on.
   • DDelete the rule and start over.
   Reveal Solution Discussion Select an answer first