Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC team has deployed a correlation rule that triggers an alert when a user account has 5 failed logins within 10 minutes. The rule is generating an overwhelming number of alerts, most of which are due to users mistyping their passwords. The team wants to reduce false positives while still detecting actual brute-force attacks. Which tuning approach is most appropriate?

   • AIncrease the threshold to 10 failed logins within the same 10-minute window.
   • BRemove the time window and trigger on any 5 failed logins for the same account.
   • CChange the rule to trigger on failed logins from a single source IP, ignoring the user account.
   • DDecrease the threshold to 3 failed logins within the same 10-minute window.
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A SOC team wants to automatically send a daily summary of high-severity alerts to the on-call incident responder at 9:00 AM. The report should include the alert count and a list of the top 5 alerts. Which configuration is correct?

   • ACreate a dashboard with the summary and share the link with the on-call responder.
   • BSchedule a report to run daily at 9:00 AM and email it to the on-call responder's address.
   • CManually generate the report each morning and email it to the on-call responder.
   • DSet up an alert that triggers when a high-severity alert is generated and email it to the on-call responder.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a correlation rule, what does the 'time window' component specify?

   • AThe frequency at which the rule is evaluated
   • BThe duration for which an alert remains active
   • CThe period during which events must occur to be considered part of the same pattern
   • DThe maximum age of logs that the SIEM will store
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A correlation rule is designed to detect port scanning by triggering when a single source IP connects to more than 20 distinct destination ports on the same host within 10 minutes. The rule is generating many false positives because a legitimate monitoring tool scans ports every 5 minutes. The team wants to keep the rule but reduce false positives. Which change is most effective?

   • AChange the rule to count connections to the same port instead of distinct ports.
   • BReduce the time window to 5 minutes.
   • CAdd the monitoring tool's source IP to an exclusion list in the rule.
   • DIncrease the threshold to 50 distinct ports.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC team wants to detect a multi-stage attack where an attacker first performs a port scan, then exploits a vulnerability, and finally establishes a command-and-control (C2) connection. The team has logs from network sensors, vulnerability scanners, and endpoint agents. What is the best way to detect this attack pattern?

   • ACreate a correlation rule that looks for a port scan event followed by an exploit event and then a C2 connection event from the same source IP within a specified time window.
   • BCreate three separate alerts: one for port scans, one for exploits, and one for C2 connections, and review them manually.
   • CCreate a rule that triggers on any C2 connection event, regardless of preceding events.
   • DCreate a rule that triggers on any port scan event, regardless of what follows.
   Reveal Solution Discussion Select an answer first