SIEM Use Case Development SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC team has developed a SIEM use case to detect a web application attack using SQL injection. The rule triggers when a URL contains common SQL injection patterns (e.g., 'OR 1=1'). During validation, the rule fires correctly on a simulated attack. However, in production it generates many false positives from legitimate search queries that contain similar patterns. The team wants to reduce false positives without missing real attacks. What is the best validation and tuning approach?

   • AIncrease the alert threshold so that the rule only fires after multiple occurrences of the pattern
   • BDisable the rule because SQL injection is not a common attack
   • CRefine the rule to require the SQL injection pattern to appear in specific parameters (e.g., 'id=') and re-test with both attack and benign traffic
   • DAdd a filter to exclude all search query URLs from the rule
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC team has developed a SIEM use case to detect lateral movement using pass-the-hash attacks. They have tested it with a known attack tool and it triggered correctly. However, in production it is generating many false positives from legitimate administrative tools. What is the most appropriate next step?

   • ADisable the rule and rely on manual review of logs.
   • BChange the rule to trigger on any NTLM authentication event.
   • CIncrease the severity of the rule so that analysts pay more attention to the alerts.
   • DAdd a filter to exclude known administrative source hosts and accounts from the rule.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   How does threat modeling help in creating effective SIEM use cases?

   • ABy prioritizing which attack scenarios to implement as use cases
   • BBy providing a list of all possible attack techniques from the MITRE ATT&CK framework
   • CBy automatically generating the correlation rules for the SIEM
   • DBy eliminating the need for log source integration
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the purpose of data source mapping in SIEM use case development?

   • ATo assign ownership of each log source to a specific analyst
   • BTo encrypt log data in transit to the SIEM
   • CTo create a visual map of the organization's network topology
   • DTo determine which log sources and data fields are needed to support the use case
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC team has developed a use case to detect command-and-control (C2) communication based on beaconing behavior. They have tested it with a known C2 framework and it triggered correctly. However, in production it is missing some C2 traffic because the beacon interval is longer than the rule's time window. What is the best way to improve the use case?

   • ADisable the use case and rely on threat intelligence feeds.
   • BRemove the time window and trigger on any single connection to an external IP.
   • CDecrease the threshold for the number of connections.
   • DIncrease the time window to capture longer beacon intervals.
   Reveal Solution Discussion Select an answer first