Dealing with False Positive Alerts SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC analyst discovers that a detection rule for a specific malware family is generating false positives because a legitimate internal tool uses the same file hash as a sample in the threat intelligence feed. The analyst has confirmed the tool is benign and widely used across the organization. What is the most appropriate action to prevent future false positives?

   • ADisable the rule for that malware family.
   • BAdd an exception for the internal tool's file path or hash in the detection rule.
   • CDocument the false positive and submit a request to remove the file hash from the threat intelligence feed.
   • DIgnore the alert because it is a known false positive.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that a detection rule for 'Suspicious PowerShell Execution' fires hundreds of times per day. Investigation shows the alerts are triggered by a legitimate administrative script that runs every 15 minutes on a small set of servers. The rule is a built-in signature that cannot be modified directly. What should the analyst do first to reduce the noise while preserving detection for other hosts?

   • ADisable the rule entirely to eliminate the noise and reduce alert fatigue.
   • BChange the rule's time window from 5 minutes to 60 minutes to reduce the number of alerts.
   • CIncrease the alert severity so the alerts are more visible to senior analysts.
   • DCreate an allowlist for the specific script hash and apply it to the rule's scope.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A detection rule for 'Suspicious PowerShell' is generating false positives because a legitimate automation script uses PowerShell to perform administrative tasks. The rule currently alerts on any PowerShell execution that includes the 'Invoke-Expression' cmdlet. The script is used by the IT team on a specific set of servers. The analyst must reduce false positives without losing detection of malicious PowerShell on other hosts. Which tuning approach is most effective?

   • AIncrease the rule's threshold to require multiple Invoke-Expression calls in a short time.
   • BDisable the rule and rely on the EDR solution to detect malicious PowerShell.
   • CChange the rule to alert only when PowerShell is executed by a non-admin user.
   • DCreate an allowlist for the specific script hash and apply it to the rule.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the first step in efficiently triaging a security alert to determine if it is a false positive?

   • AEscalate the alert to senior management for a decision
   • BDelete the alert from the SIEM to reduce noise
   • CImmediately block the source IP address to contain a potential threat
   • DCheck the alert's metadata and correlate it with relevant logs and context
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst identifies a recurring false positive caused by a misconfigured detection rule. The rule triggers on a legitimate internal application that uses the same network signature as a known malware family. The analyst has confirmed the application is benign and the rule is too broad. What is the most appropriate next step?

   • ADisable the rule immediately to stop the noise.
   • BIgnore the alert and move on because it is a known false positive.
   • CEscalate the alert to management as a critical incident.
   • DDocument the finding and submit a tuning recommendation to the detection engineering team.
   Reveal Solution Discussion Select an answer first