Automated Detection and Response GCTD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team ingests AWS CloudTrail, VPC Flow Logs, and Okta SSO logs into a central SIEM. They need to detect a specific behavior: a single user account attempting to authenticate from more than three distinct countries within a 10-minute window. The SIEM's query language supports grouping and time-window functions. Which approach best implements this detection while minimizing false positives?

   • ACreate a rule that triggers on any authentication event where the source country differs from the user's home country.
   • BUse a static list of known-good IP addresses and alert when authentication originates from an IP not on the list.
   • CWrite a query that groups authentication events by username and counts distinct source countries over a sliding 10-minute window, alerting when the count exceeds 3.
   • DSet up a threshold on the total number of authentication events per user per hour, alerting when it exceeds 10.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC manager wants to compare the effectiveness of two automated response playbooks. Playbook A has a lower average response time but a higher rate of incorrect actions (e.g., isolating non-compromised VMs). Playbook B has a higher response time but a lower error rate. Which metric should the manager use to make a balanced decision?

   • AThe total number of alerts processed, regardless of outcome.
   • BA composite metric that combines response time and accuracy, such as 'correct actions per hour' or 'mean time to effective response'.
   • COnly the response time, because speed is the most important factor.
   • DOnly the error rate, because accuracy is the most important factor.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a common method for validating automated detection mechanisms?

   • ARunning red-team exercises to simulate attacks
   • BIncreasing log retention
   • CDeleting old alerts
   • DDisabling all detection rules
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team manages hundreds of Sigma detection rules across multiple cloud environments. They want to ensure every rule is tested against a known-good dataset before deployment and that changes are tracked. Which practice best achieves this?

   • ADeploy rules directly from the SIEM's built-in rule editor without any external versioning.
   • BUse a shared network drive to store rules and rely on peer review before copying them to the SIEM.
   • CManually copy rule files to each SIEM and test them in production after deployment.
   • DStore rules in a Git repository with a CI/CD pipeline that runs automated tests against sample logs before merging to production.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multi-cloud organization uses AWS GuardDuty, Azure Defender, and GCP Security Command Center. They want a single pane of glass to correlate findings and track response metrics. Which approach is most effective?

   • AIngest findings from all three services into a central SIEM like Microsoft Sentinel, normalize the data, and build dashboards for correlation and metrics.
   • BDeploy a separate SIEM for each cloud and compare results offline.
   • CUse each cloud provider's native console separately and manually correlate findings.
   • DRely on the cloud provider's email alerts and combine them in a shared mailbox.
   Reveal Solution Discussion Select an answer first