Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is creating a correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a user uploads more than 100 MB of data to an external cloud storage service within a 15-minute window. Which components must the analyst define in the rule?

   • AA condition that counts the number of upload events, a time window of 15 minutes, and a threshold of 100 events.
   • BA condition that triggers on any upload event to external cloud storage, without a time window or threshold.
   • CA condition that sums the total bytes uploaded by the user to external cloud storage, a time window of 15 minutes, and a threshold of 100 MB.
   • DA condition that checks the user's role and triggers if the user is not an administrator, without specifying a time window or threshold.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A compliance officer requires a monthly report of all access to sensitive data. The report must be delivered to the compliance team on the first business day of each month. How should the SOC configure this?

   • ASet up an alert that triggers when a sensitive file is accessed and email that alert to the compliance team.
   • BManually run the report at the end of each month and send it to the compliance officer.
   • CSchedule the report to run on the first day of each month and email it to the compliance team distribution list.
   • DCreate a dashboard that shows the access logs and share the link with the compliance team.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common method for distributing a scheduled security report?

   • APosting it on a public website
   • BSending it via email to a predefined distribution list
   • CSaving it to a local analyst's desktop
   • DPrinting it and mailing it to each stakeholder
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC manager wants to create a dashboard for the daily morning briefing that shows the current status of high-priority alerts, the trend of alerts over the last 24 hours, and the top 5 affected assets. The audience is the SOC team and the incident commander. Which dashboard design best meets this need?

   • AA multi-tab dashboard with separate pages for alerts, trends, and assets, requiring the user to click through each tab.
   • BA dashboard that only shows a large number of raw event logs in a table format.
   • CA dashboard with only a single gauge showing the total number of alerts in the last hour.
   • DA single-page dashboard with a table of open high-priority alerts, a line chart of alert volume over the last 24 hours, and a bar chart of the top 5 assets by alert count.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager wants a single dashboard for the tier-1 analysts who monitor real-time alerts. The dashboard should show the current number of open alerts, the distribution of alerts by severity, and the most recent 10 alerts. Which set of widgets best meets this need?

   • AA heatmap of alert activity by hour, a number widget for closed alerts, and a scatter plot of alert duration.
   • BA table of all alerts from the last 7 days, a pie chart of alert owners, and a number widget for total alerts.
   • CA line chart of alert volume over the last 24 hours, a bar chart of alerts by source, and a gauge for open alerts.
   • DA number widget for open alerts, a pie chart for severity distribution, and a table for the latest alerts.
   Reveal Solution Discussion Select an answer first