Use Case and Correlation Rule Development CSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC is developing a use case to detect 'internal reconnaissance via port scans'. The organization has both NetFlow and full packet capture (PCAP) available. The analyst must decide which data source to use for the correlation rule. Which consideration is most important?

   • APCAP is required because NetFlow does not contain IP addresses.
   • BPCAP is always the best choice because it provides full payload data.
   • CNetFlow is not suitable because it cannot detect multiple connections from one source.
   • DNetFlow provides flow-level summaries that are sufficient to detect port scans and are less storage-intensive than PCAP.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which data source is most relevant for a use case that detects unauthorized access to a corporate web application?

   • ADHCP lease logs
   • BWeb server access logs
   • CFirewall traffic logs
   • DDNS query logs
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC analyst is building a correlation rule to detect 'a user downloading a large file and then sending it via email'. The organization has proxy logs and email logs. Which correlation logic is most effective?

   • ATrigger when any user downloads a large file from an external site.
   • BTrigger when the same user downloads a file over a certain size from an external site and then sends an email with an attachment within a short time window.
   • CTrigger when a user sends an email with an attachment larger than 10 MB.
   • DTrigger when any email with an attachment is sent to an external address.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common technique to reduce false positives in a correlation rule that detects multiple failed logins?

   • AIncreasing the time window to 24 hours
   • BExcluding known legitimate source IP addresses
   • CRemoving all thresholds
   • DDisabling the rule after a few days
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which element is typically included in a use case document?

   • AThe personal phone numbers of SOC analysts
   • BThe organization's marketing strategy
   • CThe rationale for why the use case is needed
   • DThe vendor's product pricing details
   Reveal Solution Discussion Select an answer first