Endpoint Analytics GCDA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is deploying endpoint detection analytics to a fleet of 5,000 endpoints. The team wants to ensure that the data is available for analysis even if the central SIEM is temporarily unavailable. Which collection strategy best meets this requirement?

   • AConfigure the endpoint agents to buffer events locally and forward them when the SIEM is reachable
   • BUse a network tap to capture all endpoint traffic and store it in the SIEM
   • CSend all events directly to the SIEM without any local storage
   • DReduce the logging level to only critical events to minimize data loss
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary role of an endpoint agent in a centralized logging architecture?

   • ACollect and forward host telemetry to a central repository
   • BProvide a user interface for analysts to query logs
   • CEncrypt all network traffic on the host
   • DReplace the need for a SIEM platform
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A rule that alerts on 'powershell.exe making outbound network connections' is producing many false positives because administrators routinely use PowerShell for remote administration. Which tuning change best reduces false positives while still detecting malicious PowerShell?

   • AChange the rule to alert only when PowerShell is run interactively
   • BRestrict the rule to alert only when the PowerShell process is launched by a known malicious parent process or from an Office application
   • CIncrease the alert threshold to require 100 outbound connections per minute
   • DAdd an exception for all administrator accounts
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A detection rule that flags PowerShell execution on endpoints is generating a high number of false positives because many administrators use PowerShell for legitimate automation. The analyst wants to reduce false positives while still detecting malicious PowerShell usage. Which tuning action is most appropriate?

   • AChange the rule to alert on all process creation events
   • BDisable the rule to eliminate all false positives
   • CAdd a filter to exclude PowerShell executions from known administrative accounts and approved automation scripts
   • DIncrease the severity of the rule so that only high-severity alerts are generated
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which action is most likely to reduce false positives for a rule that alerts on any PowerShell execution?

   • AIncreasing the alert severity
   • BAdding a filter to exclude known administrative scripts
   • CRemoving all filters from the rule
   • DDisabling the rule entirely
   Reveal Solution Discussion Select an answer first