Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is reviewing a monthly report that shows the number of incidents by category, the average time to detect, and the number of incidents that were closed without action. The analyst notices that the 'malware' category has a high number of incidents but a very low average time to detect, while the 'phishing' category has a low number of incidents but a high average time to detect. What is the most appropriate interpretation?

   • AThe malware detection is working well, but the phishing detection may need improvement because it takes longer to detect, possibly due to a lack of effective rules or visibility.
   • BThe malware category is not a concern because it is detected quickly, and the phishing category is not a concern because it has a low number of incidents.
   • CThe analyst should immediately escalate the phishing detection time to the CISO without further analysis.
   • DThe report is not useful because it does not include the number of false positives.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A monthly report shows that the number of alerts involving a specific user account has increased by 300% compared to the previous month. The report also shows that all alerts are from a single workstation and occur during business hours. What is the most likely interpretation?

   • AThe report is incorrect because the user is a trusted employee.
   • BThe increase is likely due to a new software update on the workstation.
   • CThe user may be involved in a security incident, and the workstation should be investigated.
   • DThe increase is normal because the user is more active during business hours.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC manager wants to automatically send a daily summary of all high-severity alerts to the incident response team and a weekly summary of all incidents to the management team. The reports should be generated from the SIEM and delivered via email. What is the best way to configure this?

   • ACreate a single daily report that includes both high-severity alerts and all incidents, and send it to both teams.
   • BCreate a dashboard that shows both high-severity alerts and incidents, and share the link with both teams.
   • CCreate two separate scheduled reports: one daily for high-severity alerts to the IR team, and one weekly for all incidents to management.
   • DCreate a single weekly report that includes both high-severity alerts and all incidents, and send it to both teams.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A correlation rule is generating many alerts for normal user behavior. What is the most appropriate action to reduce false positives while maintaining detection of real attacks?

   • AIncrease the threshold or adjust the time window to better match normal behavior
   • BDisable the rule entirely
   • CAdd more event sources to the rule
   • DDelete all logs that trigger the rule
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC analyst receives a weekly report that shows the number of incidents by type, the average time to resolve, and the number of open incidents. The analyst notices that the number of phishing incidents has increased by 50% compared to the previous week, while the average resolution time has decreased. What is the most appropriate action for the analyst to take?

   • AModify the report to exclude phishing incidents because they are not considered critical.
   • BInvestigate the increase in phishing incidents to determine if it is a new campaign or a false positive issue, and adjust detection rules if necessary.
   • CImmediately escalate the increase to the CISO without further analysis.
   • DIgnore the increase because the average resolution time has decreased, indicating the team is handling incidents efficiently.
   Reveal Solution Discussion Select an answer first