Automated Detection and Response GCTD Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which step is part of ingesting cloud logs into a centralized detection platform?

   • ADisabling logging on non-critical systems
   • BManually uploading log files daily
   • CWriting custom parsers for every log source
   • DConfiguring data connectors to collect logs from various sources
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the role of a SOAR platform in incident response?

   • ATo generate detection rules
   • BTo replace the SIEM
   • CTo collect and store logs
   • DTo orchestrate and automate response actions across security tools
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team has deployed a new detection rule that flags unusual outbound network connections. During the first week, the rule generated 500 alerts, but only 10 were confirmed as malicious. The team wants to improve the rule's precision without significantly reducing its recall. Which approach is most effective?

   • AAdd a condition that excludes connections to known benign IP ranges, such as internal services or well-known cloud providers.
   • BReduce the time window over which the rule counts outbound connections.
   • CIncrease the threshold for the number of outbound connections that triggers the rule.
   • DAdd a condition to the rule that requires the destination IP to be in a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key benefit of integrating detection systems with a SOAR platform?

   • AIt automatically patches all vulnerabilities
   • BIt enables automated response actions based on alerts
   • CIt replaces the need for a SIEM
   • DIt eliminates the need for security analysts
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team has a detection rule that generates a high number of false positives, causing alert fatigue. They have tried tuning the rule by adjusting thresholds, but false positives remain high. They need a more effective approach without losing true positives. Which strategy is best?

   • ACreate a second rule that duplicates the first but with a higher threshold.
   • BIncrease the severity threshold so only the most severe alerts are generated.
   • CAnalyze the false positive patterns, add exceptions or context-based conditions to the rule, and validate the changes against historical data.
   • DDisable the rule and rely on other detection methods.
   Reveal Solution Discussion Select an answer first