Automated Detection and Response GCTD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What does 'response time' measure in the context of automated detection and response?

   • AThe time taken to generate a detection rule
   • BThe time to patch a vulnerability
   • CThe time between alert generation and the start of response actions
   • DThe time to review logs manually
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which service is a cloud-native threat detection service provided by AWS?

   • AAWS CloudTrail
   • BGoogle Chronicle
   • CAzure Sentinel
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization uses AWS GuardDuty and wants to integrate findings with their SOAR platform to automate incident response. They need to ensure that only high-severity findings trigger automated actions. Which integration approach is correct?

   • AConfigure GuardDuty to send findings to Amazon EventBridge, and have a rule in EventBridge filter for high-severity findings and invoke the SOAR platform's API.
   • BManually copy high-severity findings from the GuardDuty console into the SOAR platform.
   • CSet up the SOAR platform to poll the GuardDuty API every minute and trigger actions on all findings.
   • DUse GuardDuty's built-in email notifications to send high-severity alerts to the SOAR platform's inbox.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why should a playbook include an approval process for certain actions?

   • ATo eliminate the need for automation
   • BTo increase the number of false positives
   • CTo slow down the response
   • DTo ensure that high-impact actions are authorized by appropriate personnel
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC manager wants to evaluate the effectiveness of a new detection rule that was deployed last month. The rule is designed to detect unusual PowerShell activity. The manager has access to the SIEM's alert data. Which metric is most useful for determining if the rule is generating too many false positives?

   • AThe average time taken by the SOC team to triage each alert.
   • BThe percentage of alerts that were confirmed as malicious by the SOC team.
   • CThe total number of alerts generated by the rule in the last month.
   • DThe number of unique users that triggered the rule.
   Reveal Solution Discussion Select an answer first