Correlation Rules, Dashboards, and Reports SCE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a key component of a correlation rule that defines how many events must match before an alert is triggered?

   • AThreshold
   • BTime window
   • CCorrelation name
   • DCondition
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which widget type is most appropriate to display the number of alerts by severity over the last 24 hours?

   • ASingle value widget
   • BLine chart
   • CPie chart
   • DBar chart
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SOC team deployed a correlation rule that alerts when a user account has more than 10 failed logins in 15 minutes. The rule generates hundreds of alerts daily, most of which are from a single legacy application that retries authentication aggressively. The team wants to reduce false positives without missing real brute-force attacks. Which tuning approach is most effective?

   • AIncrease the threshold to 50 failed logins in 15 minutes.
   • BCreate a separate rule for the legacy application with a higher threshold, and keep the original rule for all other traffic.
   • CExclude the legacy application's source IPs from the rule.
   • DAdd a condition that the failed logins must come from at least 3 different source IPs.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A quarterly report shows that the number of incidents classified as 'malware' has decreased by 50%, but the number of incidents classified as 'unknown' has increased by 200%. The SOC manager is unsure whether the decrease in malware is real or due to a change in detection. What is the most appropriate action?

   • AInvestigate the classification criteria and the correlation rules that assign incident types.
   • BIgnore the 'unknown' category and focus only on the malware numbers.
   • CConclude that malware incidents have genuinely decreased and allocate resources elsewhere.
   • DAssume the decrease is due to improved security controls and report it as a success.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   When interpreting a security report, what should an analyst look for to extract actionable insights?

   • AThe color scheme of the charts
   • BTrends and anomalies that indicate potential security issues
   • CThe number of lines in the report
   • DThe names of the report authors
   Reveal Solution Discussion Select an answer first