In a correlation rule, what is the purpose of a time window?

To specify how long the rule should run before it is disabled

To set the expiration date for the rule

To define the period within which events must occur to be considered related

To determine the exact time of day when the rule should be active

A SOC is documenting a use case for 'lateral movement using WMI'. The documentation must include the expected outcomes for the SOC. Which statement best describes an expected outcome?

The rule will eliminate all lateral movement in the organization.

The rule will reduce the number of WMI-related alerts to zero.

When the rule triggers, the SOC will investigate the source and target hosts, check for other signs of compromise, and contain the affected systems if malicious activity is confirmed.

The rule will automatically block all WMI traffic across the network.

A SOC team is documenting a use case for 'data exfiltration via email'. The documentation must include the rationale for the use case. Which statement best describes the rationale?

The SIEM has a built-in email correlation rule.

Email logs are easy to collect and store.

The compliance team requested more alerts.

The organization has experienced previous data-loss incidents via email, and email is a common exfiltration vector.

What is the first step in the correlation rule lifecycle?

Tuning the rule to reduce false positives

Monitoring the rule's performance

What is the primary purpose of a security use case in a SOC environment?

To list all the security tools and their configuration settings in the environment

To provide a high-level overview of the organization's risk appetite and security policies

To define a specific threat scenario and the conditions that indicate its occurrence

To document the steps an analyst should take when responding to an incident

EC-CouncilCertified SOC Analyst

Domain 4Objective 2

Use Case and Correlation Rule Development CSA Practice Questions (Page 2)

Part of the Incident Detection and Triage domain, which makes up ~16% of our current practice bank.

30questions here

6free pages

8concepts

Questions 6–10

6foundation · easy
In a correlation rule, what is the purpose of a time window?
Select an answer first
7expert · hard
A SOC is documenting a use case for 'lateral movement using WMI'. The documentation must include the expected outcomes for the SOC. Which statement best describes an expected outcome?
Select an answer first
8application · medium
A SOC team is documenting a use case for 'data exfiltration via email'. The documentation must include the rationale for the use case. Which statement best describes the rationale?
Select an answer first
9foundation · easy
What is the first step in the correlation rule lifecycle?
Select an answer first
10foundation · easy
What is the primary purpose of a security use case in a SOC environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.