Use Case and Correlation Rule Development CSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC team is developing a use case to detect data exfiltration via DNS tunneling. The team has access to DNS server logs, firewall logs, and proxy logs. Which combination of log sources and fields is most essential for this use case?

   • AFirewall logs with source and destination IP; DNS logs with query type only.
   • BDNS logs with query name, query type, and response size; firewall logs with destination IP and port.
   • CAuthentication logs with username and login time; DNS logs with query name.
   • DProxy logs with URL and user agent; DNS logs with source IP and timestamp.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A correlation rule for 'privileged account misuse' has been in production for a year. The rule triggers on any admin login outside business hours. Recently, the SOC has seen a surge in false positives because a new on-call rotation requires admins to work late. The rule also missed a real incident where an admin account was used from a compromised workstation during business hours. The SOC lead must decide how to update the rule. Which action best balances false positives and detection?

   • AChange the rule to trigger only when an admin login occurs from a non-standard workstation or a new device, regardless of time.
   • BDisable the rule during on-call hours to avoid false positives.
   • CIncrease the threshold to require multiple admin logins within a short window.
   • DKeep the rule unchanged and manually review all alerts.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC analyst has written a correlation rule to detect 'data staging' by alerting on a large number of file copies to a single directory. The analyst has a test environment that mirrors production. Which validation strategy is most effective to ensure the rule works before production deployment?

   • ARun the rule only against synthetic normal data to check for false positives.
   • BReplay a known data-staging attack scenario in the test environment and verify the rule triggers, then run a baseline of normal activity to check for false positives.
   • CDeploy the rule to production and monitor for a week.
   • DAsk a senior analyst to review the rule logic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A correlation rule that detects 'multiple failed logins' has been in production for six months. The SOC has observed that the rule no longer fires for a new brute-force tool that spreads attempts across many source IPs. What is the most appropriate lifecycle action?

   • ARetire the rule because it is no longer effective.
   • BKeep the rule unchanged and rely on manual review of logs.
   • CUpdate the rule to aggregate failed logins across source IPs for the same target user within a short window.
   • DIncrease the threshold to reduce false positives.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A newly deployed correlation rule for 'multiple failed logins followed by success' is generating a high volume of alerts during business hours. The analyst reviews the alerts and finds that most are legitimate users who mistyped their password a few times before succeeding. Which tuning adjustment would most effectively reduce false positives while preserving detection of actual brute-force attacks?

   • ARemove the 'followed by success' condition and alert on any failed logins.
   • BAdd a whitelist of known internal IP addresses to exclude from the rule.
   • CDecrease the time window so that only rapid sequences of failures trigger an alert.
   • DIncrease the failed-login threshold and require the source IP to be different from the user's typical login location.
   Reveal Solution Discussion Select an answer first