Analytic Design and Tuning GSOC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC has developed a new analytic to detect 'lateral movement using SMB'. Before deploying it to production, they run it against 30 days of historical logs. The analytic produces 500 alerts, but manual review of a random sample of 50 alerts shows only 2 are true positives. The team is under pressure to deploy the analytic. What should they do?

   • ADeploy the analytic but set it to 'informational' severity so it does not require immediate action.
   • BDeploy the analytic as-is and rely on analysts to triage the alerts.
   • CTune the analytic to reduce false positives, then re-validate against the historical data.
   • DDiscard the analytic and start over with a different detection technique.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst notices that a correlation search over 90 days of endpoint logs takes over 30 minutes to run and frequently times out. The search is used to detect 'rare' process executions. The team needs the analytic to complete within 5 minutes. Which optimization is most effective?

   • AIncrease the SIEM's memory allocation for the search.
   • BReduce the search window from 90 days to 30 days.
   • CRun the search only during off-peak hours.
   • DPre-aggregate the process execution data into a summary index on a daily basis.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to document analytic design and tuning decisions?

   • ATo reduce the number of false positives
   • BTo satisfy the requirements of the SIEM vendor
   • CTo increase the speed of the analytic
   • DTo provide a record that can be referenced for future changes and troubleshooting
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst notices that an existing analytic for 'multiple failed logons followed by success' generates hundreds of alerts each day, most of which are legitimate users who mistype passwords and then succeed. The analyst wants to reduce noise while still catching brute-force attacks. Which tuning action is most appropriate?

   • ADisable the analytic and rely on the SIEM's default correlation rules for account lockouts.
   • BIncrease the failed-login threshold and require the successful login to occur within a shorter time window after the last failure.
   • CRemove the successful-login condition and alert on any five failed logons from the same user within an hour.
   • DAdd a filter to exclude all users who have a history of password resets.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC has developed a new analytic to detect 'data staging' by monitoring file compression activity. In testing against historical data, the analytic has a 5% false positive rate and a 10% false negative rate. The SOC wants to improve the analytic before deployment. Which testing approach would provide the most useful information for tuning?

   • AIncrease the false positive rate to 10% to see if the false negative rate decreases.
   • BRun the analytic against a different historical dataset to see if the rates change.
   • CDeploy the analytic in production and monitor the alert volume for a week.
   • DAnalyze the false positives and false negatives to identify common characteristics, then adjust the analytic's filters or thresholds accordingly.
   Reveal Solution Discussion Select an answer first