Endpoint Analytics GCDA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An organization needs to detect fileless malware that runs in memory without writing to disk. Which combination of endpoint data sources is most likely to provide visibility into this activity?

   • ANetwork logs and DNS logs only
   • BFile system logs and registry logs only
   • CProcess creation logs with command-line arguments, PowerShell script block logs, and memory scanning
   • DAuthentication logs and scheduled task logs
   Reveal Solution Discussion Select an answer first
2. 32expert · hard · select all that apply

   A detection rule for 'suspicious process injection' is generating a high number of false positives from legitimate security tools and development environments. The team wants to reduce false positives while maintaining detection of actual injection attacks. Select all that apply. Which tuning actions are appropriate?

   • ARefine the rule to focus on injection into high-value processes like lsass.exe or winlogon.exe
   • BIncrease the threshold to require the injection to occur at least 5 times in 10 minutes
   • CAdd exceptions for known legitimate security tools that perform injection as part of their normal operation
   • DChange the rule to alert only on injection performed by unsigned binaries
   • EDisable the rule entirely to eliminate all false positives
   Check answers Discussion Select an answer first
4. 33expert · hard

   A detection rule that flags the creation of scheduled tasks is generating false positives because a legitimate backup application creates a scheduled task every night. The security team has limited analyst time and wants to reduce false positives while still detecting malicious scheduled task creation. Which tuning approach is most effective?

   • AIncrease the rule's threshold to require two scheduled tasks to be created in a short time
   • BChange the rule to alert only when the scheduled task runs immediately
   • CSuppress alerts for the backup application's scheduled task by excluding its task name and source process
   • DDisable the rule during the backup window
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has endpoints that are not always connected to the corporate network. They need to ensure that endpoint telemetry is collected and delivered to the SIEM even when devices are offline for extended periods. Which collection strategy is most reliable?

   • ARely on the VPN to forward logs in real time when the device is connected
   • BUse an agent with persistent local storage that queues events and retries delivery with exponential backoff when connectivity is restored
   • CUse a central collector that polls endpoints periodically for new events
   • DStore logs only on the endpoint and never forward them
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A detection engineer is tuning an anomaly detection model that monitors the number of processes spawned per hour on each endpoint. The model is generating too many alerts for endpoints that are used for batch processing. Which tuning approach is most appropriate?

   • ACreate separate baselines for endpoints that perform batch processing
   • BDisable the model for batch processing endpoints
   • CReduce the time window for the model
   • DIncrease the alert threshold globally for all endpoints
   Reveal Solution Discussion Select an answer first