Use Case and Correlation Rule Development CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is designing a correlation rule to detect a 'pass-the-hash' attack. The rule should combine authentication logs and endpoint logs. Which correlation logic best identifies this attack?

   • AAlert when an authentication event from a workstation uses a hash (NTLM) and is followed by a remote admin login from the same workstation to another host.
   • BAlert when a user's account is locked out multiple times.
   • CAlert when a workstation sends a large amount of data to an external IP.
   • DAlert when any user logs in with a password from a new device.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a likely consequence of setting a very high threshold in a correlation rule?

   • AIncreased false negatives
   • BIncreased false positives
   • CNo change in detection accuracy
   • DFaster rule execution
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC team has a correlation rule that detects 'possible ransomware activity' by alerting on rapid file renames in a file share. The rule is generating a high number of false positives because a backup application also renames files. The team wants to reduce false positives without missing actual ransomware. Which approach is most effective?

   • ADisable the rule during backup windows.
   • BAdd a condition to exclude file renames performed by the backup service account and require the rename pattern to match known ransomware extensions.
   • CChange the rule to alert on any file deletion instead of renames.
   • DIncrease the threshold for the number of renames within the time window.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why might a correlation rule be retired?

   • ATo make the SIEM run faster
   • BTo increase the number of alerts
   • CTo comply with a vendor's marketing campaign
   • DThe threat it detects is no longer relevant to the environment
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which scenario best illustrates the use of a correlation rule?

   • AA user logs in from a new location and then performs a privileged action within a short time
   • BA firewall drops a packet because it violates an access control list
   • CAn antivirus alert is generated for a single malware detection on one workstation
   • DA single failed login attempt is logged by the authentication server
   Reveal Solution Discussion Select an answer first