SIEM Use Case Development SCE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC has a SIEM use case that detects suspicious scheduled tasks. The rule was developed a year ago and has not been reviewed since. Recently, the rule has been generating many false positives because a new IT automation tool creates scheduled tasks with similar names. The SOC also has a new compliance requirement to review all use cases annually. What is the best course of action?

   • ADisable the rule until the annual review is completed
   • BOnly update the documentation to note the false positives, but leave the rule unchanged
   • CConduct a full review of the use case, including the new IT tool, and update the rule and documentation as part of the annual lifecycle
   • DImmediately update the rule to exclude the IT automation tool and document the change
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC is creating a new use case to detect unauthorized use of privileged accounts. The team has already identified the threat scenario and mapped the required log sources. According to the standard use case development process, what should they do next?

   • AImmediately create an alert response playbook and train analysts on it
   • BConstruct the correlation rule, test it with known attack scenarios, and then tune it before production
   • CDocument the use case and schedule a review for six months later
   • DWrite the correlation rule and deploy it directly to production
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC has developed a SIEM use case that detects suspicious PowerShell activity. After several months, the rule is generating many false positives due to a new administrative script that uses similar patterns. The team updates the rule to exclude the script. What documentation and maintenance practice should the team follow?

   • AKeep the documentation unchanged because the rule still detects the original threat
   • BOnly update the documentation if the rule is completely rewritten
   • CUpdate the use case documentation to reflect the new exclusion and note the reason for the change
   • DDelete the old documentation and create a new use case from scratch
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager wants to ensure that SIEM use cases remain effective over time as the environment changes. Which practice is most important to establish?

   • ARe-test use cases only when a new attack tool is released.
   • BAutomatically disable any use case that generates more than 10 alerts per day.
   • CDocument the use case only at the time of creation and store it in a shared folder.
   • DSchedule a quarterly review of each use case to assess its relevance, false-positive rate, and alignment with current threats.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of a SIEM use case?

   • ATo automatically remediate security incidents without human intervention
   • BTo store raw logs for compliance and forensic investigation
   • CTo define a rule or correlation that detects a specific threat or security event
   • DTo replace the need for security analysts in incident response
   Reveal Solution Discussion Select an answer first