Analytic Design and Tuning GSOC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key input to the continuous improvement process for security analytics?

   • AThe color of the alert dashboard
   • BThe vendor of the SIEM platform
   • CFeedback from analysts who review alerts
   • DThe number of servers in the data center
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the principle of 'scope' in analytic design?

   • AThe specific set of behaviors, events, or entities the analytic is designed to detect
   • BThe geographic region where the analytic will be deployed
   • CThe amount of false positives the analytic is expected to generate
   • DThe number of data sources the analytic will query
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC's analytic for 'malware C2 beaconing' alerts when a host makes a connection to an external IP every 60 seconds. The analytic has a high false positive rate because some legitimate software also polls at regular intervals. The team wants to reduce false positives while still detecting beaconing. Which approach is most effective?

   • ARemove the time interval and alert on any connection to a known malicious IP.
   • BAlert on any connection to an external IP that occurs more than 10 times in an hour.
   • CIncrease the beacon interval to 5 minutes to reduce the number of alerts.
   • DAdd a requirement that the beacon interval be consistent within a small variance and that the destination IP be in a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary risk of over-tuning an analytic to eliminate false positives?

   • AThe analytic will require more storage
   • BThe analytic will generate more alerts
   • CThe analytic may miss true threats (increase false negatives)
   • DThe analytic will run slower
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC has a quarterly review process for all analytics. During a review, they find that an analytic for 'privilege escalation' has not triggered in six months, but a recent penetration test showed that the technique it detects is still possible. What should the team do?

   • ALower the threshold so the analytic fires more often.
   • BInvestigate why the analytic has not fired, including checking data source health and testing the analytic against known-good attack simulations.
   • CRemove the analytic because it is not firing.
   • DKeep the analytic unchanged and assume the technique is not being used.
   Reveal Solution Discussion Select an answer first