Automated Detection and Response GCTD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security engineer is writing a Sigma rule to detect a suspicious sequence of Azure Active Directory sign-in events followed by a high-volume download from SharePoint Online. The engineer needs the rule to match only when the sign-in events and the download occur within a 10-minute window for the same user. The team's SIEM ingests raw JSON logs from both Azure AD and Office 365. Which approach best satisfies the requirement while keeping the rule maintainable?

   • AWrite two separate Sigma rules — one for the sign-in anomaly and one for the download volume — and rely on the SIEM's alert deduplication to merge them into one incident.
   • BUse a KQL query in the SIEM that joins the two tables on user ID and timestamp, then convert the entire query into a Sigma rule using the SIEM's built-in converter.
   • CCreate a single Sigma rule that checks for the presence of both event types in the same raw log entry, since Azure AD and SharePoint logs are ingested together.
   • DWrite a single Sigma rule with a correlation condition that references normalized fields for user ID and event type, and configure the SIEM's correlation engine to evaluate the 10-minute window.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of event normalization in a centralized detection platform?

   • ATo convert diverse log formats into a common schema for consistent analysis
   • BTo delete irrelevant logs to save storage
   • CTo encrypt logs in transit
   • DTo generate alerts from raw logs
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is deploying automated detection in their cloud environment. They want to ensure that the detection system can handle the volume of logs generated by their applications without losing data. Which design consideration is most important?

   • AEnsure the detection rules are written in a portable format like Sigma.
   • BEnsure the log ingestion pipeline can scale horizontally to handle peak log volumes.
   • CEnsure the detection rules are tested against historical data.
   • DEnsure the detection system is integrated with a SOAR platform.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses Google Chronicle for detection and wants to integrate it with their SOAR platform to automate incident response. They want the SOAR to create an incident and enrich it with threat intelligence from Chronicle. Which integration approach is most appropriate?

   • AExport Chronicle detections to a SIEM, and have the SIEM forward them to the SOAR platform, which then queries the SIEM for enrichment.
   • BUse Chronicle's built-in SOAR connector that automatically creates incidents and enriches them without any custom configuration.
   • CConfigure the SOAR platform to periodically pull detection alerts from Chronicle using a scheduled query, and have the SOAR playbook use the same data for enrichment.
   • DUse Chronicle's API to push detection alerts to the SOAR platform, and configure the SOAR playbook to query Chronicle's API for enrichment data.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is Sigma used for in detection rule development?

   • AA query language for Azure Sentinel
   • BA standardized format for writing detection rules that can be converted to multiple SIEM query languages
   • CA tool for automating incident response
   • DA cloud-native detection service
   Reveal Solution Discussion Select an answer first