Dealing with False Positive Alerts SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC team uses a network detection rule that alerts when a host communicates with an IP address on a threat intelligence blocklist. The rule generates many false positives because a legitimate SaaS application used by the company shares an IP range with a known malicious actor. The team wants to reduce false positives without losing visibility into malicious communications. Which action is most appropriate?

   • ARemove the IP range from the threat intelligence feed.
   • BIncrease the alert threshold to require multiple communications with the same IP.
   • CAdd an exception for the legitimate SaaS application's domains or IPs in the detection rule.
   • DDisable the rule that uses the threat intelligence feed.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC team is tuning a detection rule that alerts on the use of a specific hacking tool. The rule currently generates a high number of false positives because a legitimate penetration testing team uses the same tool during scheduled assessments. The team wants to reduce false positives while maintaining detection of unauthorized use of the tool. The penetration testing schedule is known in advance. Which approach is most appropriate?

   • ADisable the rule during scheduled penetration tests and re-enable it after.
   • BAdd a permanent exception for the penetration testing tool's process name.
   • CIncrease the alert threshold to require multiple uses of the tool within a short time period.
   • DCreate a suppression window that matches the scheduled penetration test times and suppress alerts from the penetration testing team's source IPs.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst notices that a specific EDR rule triggers dozens of times per day on a developer workstation. The alert fires when a process reads the Windows registry key that stores the last user's logon time. Developers routinely run a build tool that queries this key. The rule was originally created to detect credential-access techniques. The analyst wants to reduce noise without losing visibility into genuine credential-access attempts. Which action is most appropriate?

   • ARefine the rule to require additional context, such as the parent process or command-line arguments, before alerting.
   • BDisable the rule entirely because it is clearly not detecting real attacks.
   • CIncrease the alert severity so the analyst pays more attention to it.
   • DAdd an exception for the specific developer workstation's hostname.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An organization's intrusion detection system (IDS) is generating many alerts for a specific signature that matches a legitimate internal application's traffic. What is the most likely cause of these false positives?

   • AThe IDS sensor is placed in a network segment that does not see the application's traffic
   • BThe IDS signature is outdated and no longer reflects current attack patterns
   • CThe IDS is configured with a rule that is too specific and only matches the exact attack pattern
   • DThe IDS is not configured to exclude the internal application's known traffic patterns
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC team is experiencing a high rate of false positives, and analysts are beginning to ignore alerts. The team lead is concerned that a true positive will be missed. The team has limited resources and cannot increase staffing. Which strategy is most effective for mitigating the risk of missing a true positive?

   • ARequire analysts to investigate every alert in the order it was received.
   • BImplement a triage process that prioritizes alerts based on severity and asset criticality, and document false positives to tune rules.
   • CIncrease the alert severity for all alerts so that analysts pay more attention.
   • DDisable all low-severity alerts to reduce the volume.
   Reveal Solution Discussion Select an answer first