Dealing with False Positive Alerts SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC team has a documented process for handling false positives. An analyst identifies a new false positive caused by a recently deployed application. The analyst documents the finding and submits a tuning recommendation to the detection engineering team. However, the detection engineering team is backlogged and cannot implement the change for several weeks. In the meantime, the false positive continues to generate alerts. What is the most appropriate action for the analyst to take?

   • ASuppress the alert temporarily until the tuning change is implemented, while documenting the suppression.
   • BContinue to investigate each alert as it comes in, even though it is a known false positive.
   • CEscalate the false positive to management as a critical incident.
   • DDisable the rule entirely to stop the false positives.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst notices that a detection rule for 'Malicious File Download' is generating many false positives after a recent software update. The rule uses a signature that matches a specific file hash. The software update changed the hash of a legitimate application that is widely used in the organization. What is the most likely cause of the false positives?

   • AThe rule is generating false positives because the software update changed the file's behavior.
   • BThe rule is generating false positives because the software update introduced a new vulnerability.
   • CThe rule is generating false positives because the software update increased the file's entropy.
   • DThe rule is misconfigured because the signature was not updated to reflect the new hash.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company recently deployed a new EDR solution. The SOC team notices that the EDR generates many false positives for a legitimate software update process that runs nightly. The update process downloads files from a vendor CDN and executes them. The EDR rule flags the execution of files from an untrusted domain. The team wants to reduce false positives without weakening detection of actual malware downloads. Which approach is most appropriate?

   • ADisable the rule that flags untrusted domain downloads.
   • BAdd the vendor CDN domain to an allowlist in the EDR rule.
   • CIncrease the EDR log retention to keep more data for analysis.
   • DChange the rule to alert on all file executions regardless of domain.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC team has been receiving hundreds of false positive alerts per day from a misconfigured IDS rule. Analysts have started to ignore the alerts because they are almost always benign. One day, a real intrusion triggers the same rule, but the alert is not investigated until the next shift. What is the most significant operational impact of this situation?

   • AThe true positive alert was missed because of alert fatigue caused by the high volume of false positives.
   • BThe SOC will be fined for not meeting its service-level agreement for alert response.
   • CThe IDS rule will need to be reconfigured before it can generate any more alerts.
   • DThe team is wasting storage and compute resources on logs that are not useful.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which technique is most effective for reducing false positives while preserving detection of genuine threats?

   • ADeleting all logs that match the false positive pattern
   • BAdding specific exceptions to detection rules for known benign activity
   • CDisabling detection rules that generate any false positives
   • DIncreasing the alert threshold to a level that only fires on confirmed attacks
   Reveal Solution Discussion Select an answer first