Dealing with False Positive Alerts SCE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Why is it important to document false positive findings in a security operations center?

   • ATo increase the workload of junior analysts
   • BTo prove that the SOC is actively monitoring alerts
   • CTo provide a reference for future triage and to help tune detection rules
   • DTo share with external auditors as evidence of compliance
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A detection rule for 'Anomalous Outbound DNS Traffic' is generating a high volume of false positives because some endpoints use a legitimate dynamic DNS service. The rule currently triggers on any DNS query to a domain with a high entropy name. Which tuning change would most effectively reduce false positives while still detecting malicious DNS tunneling?

   • AIncrease the time window from 5 minutes to 1 hour to reduce the number of alerts.
   • BChange the rule to alert only on DNS queries to domains that are not in the top 1 million most-visited domains.
   • CLower the entropy threshold so that only very high entropy names trigger the rule.
   • DAdd the legitimate dynamic DNS domains to an allowlist and keep the entropy threshold unchanged.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC analyst is triaging a queue of alerts. One alert is a 'Medium' severity alert for 'Suspicious Scheduled Task' on a server that is known to have legitimate scheduled tasks. Another alert is 'Low' severity for 'Unusual Login Time' for a user who often works late. The analyst has limited time and must decide which alert to investigate first. The scheduled task alert is new, and the login time alert is recurring. Which alert should be investigated first?

   • AThe 'Unusual Login Time' alert, because it is low severity but recurring.
   • BInvestigate both alerts simultaneously to save time.
   • CIgnore both alerts and wait for additional corroborating evidence.
   • DThe 'Suspicious Scheduled Task' alert, because it is new and may indicate a persistence mechanism.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC team has been documenting false positives in a spreadsheet, but the detection engineering team is not using the documentation to improve rules. The false positive rate remains high, and analysts are frustrated. The team lead wants to improve the feedback loop. Which action is most likely to improve the situation?

   • AStop documenting false positives because the documentation is not being used.
   • BCreate a formal process where false positive documentation is reviewed in a weekly meeting with the detection engineering team.
   • CSend the spreadsheet to the detection engineering team once a month.
   • DAsk the detection engineering team to review the spreadsheet on their own time.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After investigating a recurring false positive alert, an analyst determines that the rule is triggering on a legitimate backup process that runs every night. The analyst wants to document the finding and provide feedback to improve the detection mechanism. What is the most appropriate action?

   • ADelete the alert logs to free up storage and reduce the noise.
   • BSilently modify the rule to exclude the backup process and do not tell anyone.
   • CSend an email to the entire SOC team explaining that the alert is a false positive and should be ignored.
   • DSubmit a ticket to the detection engineering team with the alert details, the investigation results, and a recommendation to add the backup process to an allowlist.
   Reveal Solution Discussion Select an answer first