SIEM Use Case Development SCE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is documentation important for SIEM use cases?

   • AIt provides a reference for analysts and helps maintain consistency in detection and response
   • BIt reduces the need for testing and tuning
   • CIt automatically improves the detection accuracy of the use case
   • DIt is required by law for all SIEM deployments
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC team has developed a use case to detect lateral movement using pass-the-hash. They have tested it with a known attack tool and it triggers correctly. However, they are concerned about false positives from legitimate administrative tools that also use remote logon. What is the best validation approach?

   • AOnly test with the attack tool because the rule is already known to work
   • BRun the rule in a test environment with both the attack tool and a set of legitimate administrative activities to compare alert output
   • CDeploy the rule to production and monitor alerts for a week
   • DAsk the vendor of the attack tool to confirm the rule is correct
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A SOC team has developed a use case to detect lateral movement using remote PowerShell. They have tested it with a known attack tool and it triggered correctly. However, in production, the rule is missing detections because some endpoints do not forward PowerShell logs to the SIEM. The team has limited resources and cannot enable log forwarding on all endpoints immediately. What is the best approach to improve detection coverage?

   • AIncrease the rule's threshold to reduce false positives from the endpoints that do forward logs.
   • BPrioritize enabling PowerShell log forwarding on the most critical endpoints, such as domain controllers and servers hosting sensitive data.
   • CDisable the use case until all endpoints can forward logs.
   • DRely on threat intelligence feeds to detect lateral movement instead.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team has developed a SIEM use case to detect data exfiltration via large outbound file transfers. The rule triggers when a single user uploads more than 500 MB to an external cloud storage service within 15 minutes. During validation, the rule fires correctly on a simulated exfiltration. However, in production it generates many false positives from a marketing team that regularly uploads large video files. The team cannot exclude the marketing team entirely because they are also at risk of insider threats. What is the best approach?

   • AChange the rule to alert only when the upload is to a known malicious domain
   • BCreate a separate baseline for the marketing team and alert only when their upload volume deviates significantly from their normal pattern
   • CDisable the rule for the marketing team's source IP range
   • DIncrease the threshold to 2 GB per 15 minutes for all users
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SIEM use case for detecting malware beaconing is generating too many false positives from a legitimate application that periodically checks for updates. The SOC wants to reduce noise without missing real C2 traffic. Which tuning action is most appropriate?

   • AAdd a filter to exclude the known legitimate application's domain and process name.
   • BChange the rule to trigger on any outbound connection to an external IP.
   • CIncrease the alert severity to make the false positives more visible.
   • DDisable the rule and create a new one that only triggers on known malware signatures.
   Reveal Solution Discussion Select an answer first