Endpoint Analytics GCDA Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   A detection rule that alerts on the creation of new local admin accounts is generating false positives because a legitimate IT tool creates temporary admin accounts during maintenance. The analyst wants to reduce false positives without missing real creation of admin accounts. Which action is most appropriate?

   • AIncrease the rule's threshold to require two admin accounts to be created in a short time
   • BChange the rule to alert only when the account is used to log in
   • CAdd a suppression window for admin account creation that matches the maintenance window and exclude the IT tool's account naming pattern
   • DDisable the rule during the maintenance window
   Reveal Solution Discussion Select an answer first
2. 42application · easy

   An organization wants to detect unauthorized changes to critical system binaries. Which endpoint data source is most directly suited for this detection?

   • AAuthentication logs
   • BProcess creation logs
   • CFile integrity monitoring logs
   • DNetwork connection logs
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A security team is deploying endpoint detection analytics to a remote workforce. The endpoints are laptops that are often offline and connect via VPN. The team needs to ensure that endpoint data is available for analysis in the SIEM, but they also need to minimize the impact on the laptops' performance and battery life. Which collection strategy best meets these conflicting requirements?

   • ACollect only high-severity events to reduce data volume and performance impact
   • BStream all endpoint data to the SIEM in real time over the VPN
   • CUse a cloud-based collector that pulls data from the laptops on demand
   • DConfigure the endpoint agent to collect and buffer data locally, and forward it to the SIEM when the laptop is on VPN and idle
   Reveal Solution Discussion Select an answer first