Dealing with False Positive Alerts SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How can a high rate of false positives indirectly increase the risk of a successful cyberattack?

   • ABy consuming analyst time and attention, causing genuine alerts to be deprioritized or missed
   • BBy increasing the number of security tools, which creates more attack surface
   • CBy causing the firewall to block legitimate traffic, leading to business disruption
   • DBy making the security team more cautious, which slows down incident response
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst has confirmed that a recurring alert is a false positive caused by a legacy application that sends malformed network packets. The analyst wants to document the finding and provide feedback to improve the detection mechanism. What is the most appropriate way to document this?

   • ASend an email to the SOC team with the alert ID and a note to ignore it.
   • BCreate a knowledge base article that describes the false positive, the cause, and the recommended tuning action.
   • CDelete the alert and all associated logs to reduce noise.
   • DAdd a comment to the alert and close it without further action.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A SOC analyst receives an alert from an endpoint detection tool indicating that a user executed a PowerShell command that matches a known malicious script pattern. Upon investigation, the analyst determines that the user is a system administrator who ran a legitimate automation script that happens to contain similar syntax. The script is approved and documented. How should the analyst classify this alert?

   • AFalse negative because the alert should have been suppressed.
   • BTrue negative because no malicious activity occurred.
   • CTrue positive because the pattern matched the malicious script.
   • DFalse positive because the activity is benign and the alert fired incorrectly.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC analyst is triaging a queue of alerts. One alert is a 'High' severity alert for 'Data Exfiltration' from a file server, but the analyst knows that the file server is used for large data transfers by the marketing team. Another alert is 'Medium' severity for 'Malicious Command Execution' on a user workstation. The analyst has limited time and must decide which alert to investigate first. The file server alert has been recurring every day for a week, and the workstation alert is new. Which alert should be investigated first?

   • AInvestigate both alerts simultaneously to save time.
   • BThe 'Data Exfiltration' alert, because it is high severity and involves a file server.
   • CThe 'Malicious Command Execution' alert, because it is new and may indicate an active compromise.
   • DIgnore both alerts and wait for additional corroborating evidence.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team uses a SIEM rule that alerts when a user logs in outside of business hours. The rule generates many false positives because employees in different time zones and on-call staff regularly log in at night. The team wants to reduce false positives while still detecting unusual after-hours activity. Which approach is most effective?

   • ACreate a baseline of normal after-hours activity for each user and alert only on deviations from that baseline.
   • BChange the rule to alert on all logins regardless of time.
   • CIncrease the alert severity to force analysts to review each alert.
   • DRemove the rule because after-hours logins are not a reliable indicator.
   Reveal Solution Discussion Select an answer first