An organization has a detection rule that flags any process that writes to the startup folder. The rule is generating a high volume of alerts, but the security team has limited analyst time. They want to reduce the alert volume while still detecting malicious persistence. The organization has a known set of approved applications that write to the startup folder during installation. Which tuning approach best balances reducing false positives and maintaining detection coverage?

Change the rule to alert only when the process is unsigned

Disable the rule and rely on periodic manual review of startup folder contents

Increase the alert threshold to require the process to write to the startup folder multiple times

Create an allowlist of approved applications and suppress alerts for those, while keeping the rule active for all other processes

A security team manages 5,000 endpoints across multiple sites. They need to collect process, network, and file events for detection, but the central SIEM has limited ingestion capacity. The team must prioritize which events to send. Which approach best balances detection coverage with SIEM capacity?

Deploy agents that filter events locally based on risk and send only high-value events to the SIEM

Use a central collector that samples 10% of endpoints each day

Collect only authentication logs and rely on network monitoring for the rest

Send all raw events to the SIEM and increase the retention period

A security team has a detection rule that flags any use of PsExec on endpoints. The rule generates many false positives because system administrators use PsExec for legitimate remote administration. The team wants to reduce false positives while still detecting malicious use of PsExec. They have a list of known administrative accounts and a list of approved administrative workstations. Which tuning approach is most effective?

Exclude PsExec executions that originate from approved administrative workstations and are run by known administrative accounts

Disable the rule and rely on manual review of PsExec usage

Increase the severity of the rule to reduce the number of alerts

Alert only when PsExec is used to run a process that is not on a pre-approved list

A detection rule flags any process that creates a file in the Windows startup folder. The rule generates hundreds of alerts per day because a legitimate software updater writes there during routine patching. Which tuning action is most effective while preserving detection of malicious persistence?

Change the rule to alert only when the file is created by a process with a digital signature

Increase the alert severity so analysts pay more attention

Add an exception for the specific updater executable path and keep the rule for all other processes

Disable the rule entirely to eliminate the noise

GIAC Certified Detection Analyst

Domain 4Objective 1

Endpoint Analytics GCDA Practice Questions (Page 5)

Part of the Endpoint and User Analytics domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 7–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21foundation · easy
Which analytical technique is most appropriate for linking a suspicious process execution on one host to a subsequent authentication event on another host?
Select an answer first
22expert · hard
An organization has a detection rule that flags any process that writes to the startup folder. The rule is generating a high volume of alerts, but the security team has limited analyst time. They want to reduce the alert volume while still detecting malicious persistence. The organization has a known set of approved applications that write to the startup folder during installation. Which tuning approach best balances reducing false positives and maintaining detection coverage?
Select an answer first
23expert · hard
A security team manages 5,000 endpoints across multiple sites. They need to collect process, network, and file events for detection, but the central SIEM has limited ingestion capacity. The team must prioritize which events to send. Which approach best balances detection coverage with SIEM capacity?
Select an answer first
24expert · hard
A security team has a detection rule that flags any use of PsExec on endpoints. The rule generates many false positives because system administrators use PsExec for legitimate remote administration. The team wants to reduce false positives while still detecting malicious use of PsExec. They have a list of known administrative accounts and a list of approved administrative workstations. Which tuning approach is most effective?
Select an answer first
25application · medium
A detection rule flags any process that creates a file in the Windows startup folder. The rule generates hundreds of alerts per day because a legitimate software updater writes there during routine patching. Which tuning action is most effective while preserving detection of malicious persistence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Endpoint Analytics GCDA Practice Questions (Page 5)

Questions 21–25

Which analytical technique is most appropriate for linking a suspicious process execution on one host to a subsequent authentication event on another host?

A detection rule flags any process that creates a file in the Windows startup folder. The rule generates hundreds of alerts per day because a legitimate software updater writes there during routine patching. Which tuning action is most effective while preserving detection of malicious persistence?

Keep studying — Endpoint and User Analytics