Dealing with False Positive Alerts SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A detection rule for 'Anomalous Network Traffic' is generating false positives because a new network monitoring tool is sending large amounts of data that the rule interprets as suspicious. The rule was tuned for the previous network baseline. The analyst must reduce false positives without losing detection of real anomalies. Which action is most appropriate?

   • AUpdate the rule's baseline to reflect the new network traffic patterns.
   • BDisable the rule and rely on the network monitoring tool to detect anomalies.
   • CIncrease the rule's threshold to reduce the number of alerts.
   • DAdd the network monitoring tool's IP address to an allowlist.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC team is experiencing a high rate of false positives from a specific detection rule. The rule is designed to detect command-and-control (C2) beaconing by flagging regular outbound connections to a single external IP. Analysts are spending significant time investigating these alerts, and as a result, a genuine C2 alert from a different rule was missed. The team has limited resources and cannot manually review every alert. Which approach best balances the need to reduce false positives while maintaining detection of C2 activity?

   • ATune the rule to require additional context, such as the destination port, protocol, or a correlation with other suspicious activity, before alerting.
   • BIncrease the alert severity for the C2 rule so analysts prioritize it over other alerts.
   • CDisable the C2 beaconing rule to eliminate the false positives and free up analyst time.
   • DCreate a separate queue for C2 alerts and assign a dedicated analyst to review them.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC analyst is triaging a queue of alerts. One alert is a 'Critical' severity alert for 'Lateral Movement' from a domain controller, but the analyst knows that the domain controller was recently patched and rebooted. Another alert is 'Medium' severity for 'Unusual Outbound Connection' from a user workstation. The analyst has limited time. Which alert should be investigated first?

   • AInvestigate both alerts simultaneously to save time.
   • BIgnore both alerts and wait for additional corroborating evidence.
   • CThe 'Unusual Outbound Connection' alert, because it is more likely to be a true positive.
   • DThe 'Lateral Movement' alert, because it is critical severity and involves a domain controller.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A detection rule for 'Excessive Failed Logons' is generating false positives because a legacy application uses a service account that periodically locks out. The rule currently triggers on 10 failed logons within 5 minutes. The analyst wants to reduce false positives without missing a brute-force attack. Which tuning change is most appropriate?

   • AChange the time window from 5 minutes to 15 minutes.
   • BAdd the service account to an allowlist so it does not trigger the rule.
   • CIncrease the threshold to 20 failed logons within 5 minutes.
   • DDisable the rule and rely on the endpoint protection to detect brute-force attacks.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   During alert triage, which finding most strongly suggests that an alert is a false positive?

   • AThe alert was generated during a scheduled vulnerability scan
   • BThe activity matches a known legitimate business process and originates from an authorized system
   • CThe alert has a high severity score assigned by the SIEM
   • DThe alert includes a packet capture that shows encrypted traffic
   Reveal Solution Discussion Select an answer first