A SOC team has a correlation rule that triggers an alert when a user logs in from a new geographic location. The rule is producing many false positives because users frequently travel and log in from new locations. The team wants to reduce false positives while still detecting potentially compromised accounts. Which tuning approach is most effective?

Change the rule to trigger on any login from a new location, regardless of user or time.

Increase the alert severity to make the alerts more visible, but keep the rule unchanged.

Disable the rule entirely to stop the false positives.

Add a condition that the login occurs outside the user's normal working hours or from a location that is not in the user's travel history.

A SOC has a requirement that the Level 1 analysts should only see alerts that are assigned to them, while the Level 2 analysts should see all alerts and additional investigation tools. The SOC manager wants to enforce this through dashboard customization. What is the best way to achieve this?

Create a single dashboard that shows all alerts and give both teams the same access.

Create a dashboard for Level 1 that shows all alerts, and a separate dashboard for Level 2 that shows only assigned alerts.

Create two dashboard roles: one for Level 1 that filters alerts by assigned analyst, and one for Level 2 that shows all alerts and includes investigation widgets.

Create a single dashboard and rely on the analysts to manually filter the alerts they want to see.

A SOC team wants to automatically distribute a daily report of all new high-severity alerts to the on-call incident responder and a weekly report of all resolved incidents to the SOC manager. What is the best way to configure the report distribution?

Create two scheduled reports: one daily for high-severity alerts to the on-call responder, and one weekly for resolved incidents to the SOC manager.

Create a single weekly report that includes both high-severity alerts and resolved incidents, and send it to both stakeholders.

Create a dashboard that shows both high-severity alerts and resolved incidents, and share the link with both stakeholders.

Create a single daily report that includes both high-severity alerts and resolved incidents, and send it to both the on-call responder and the SOC manager.

What is the primary goal of tuning a correlation rule?

To reduce false positives while maintaining true positive detection

To increase the number of alerts generated

A security report shows a sudden spike in failed login attempts from a single IP address. What is the most appropriate interpretation?

It means the user has forgotten their password

It indicates that the firewall is working correctly

It may indicate a brute-force attack and should be investigated

It is likely a false positive and can be ignored

EC-CouncilSOC Essentials

Domain 6Objective 2

Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 6)

Part of the Incident Detection and Analysis domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

10concepts

Questions 26–30

26application · medium
A SOC team has a correlation rule that triggers an alert when a user logs in from a new geographic location. The rule is producing many false positives because users frequently travel and log in from new locations. The team wants to reduce false positives while still detecting potentially compromised accounts. Which tuning approach is most effective?
Select an answer first
27application · medium
A SOC has a requirement that the Level 1 analysts should only see alerts that are assigned to them, while the Level 2 analysts should see all alerts and additional investigation tools. The SOC manager wants to enforce this through dashboard customization. What is the best way to achieve this?
Select an answer first
28application · medium
A SOC team wants to automatically distribute a daily report of all new high-severity alerts to the on-call incident responder and a weekly report of all resolved incidents to the SOC manager. What is the best way to configure the report distribution?
Select an answer first
29foundation · easy
What is the primary goal of tuning a correlation rule?
Select an answer first
30foundation · easy
A security report shows a sudden spike in failed login attempts from a single IP address. What is the most appropriate interpretation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.