Analytic Design and Tuning GSOC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of tuning a security analytic?

   • ATo make the analytic run faster
   • BTo eliminate all alerts
   • CTo increase the number of alerts generated
   • DTo reduce both false positives and false negatives to an acceptable level
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common tuning parameter in security analytics?

   • ASIEM vendor
   • BTime window
   • CIncident response plan
   • DAlert severity level
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC's SIEM is struggling with the load from a real-time correlation search that joins endpoint events with Active Directory account data. The search is causing delays in other critical alerts. The team needs to maintain real-time detection but reduce the load. Which action is most appropriate?

   • ADisable the analytic during peak business hours.
   • BIncrease the SIEM's hardware resources to handle the load.
   • CRemove the join with Active Directory data and use only endpoint events.
   • DRun the correlation search every 15 minutes instead of continuously.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of a security use case in analytic design?

   • ATo provide a training guide for new analysts
   • BTo list all possible data sources available in the environment
   • CTo translate an operational requirement into a specific detection rule or query
   • DTo document the business impact of a security incident
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC's analytic for 'malicious PowerShell' alerts on any PowerShell process that downloads a file from the internet. The alert volume is high, and analysts are ignoring it. The team wants to reduce false positives while still detecting malicious downloads. They have observed that legitimate IT automation downloads from a known internal server. Which tuning approach best balances false positives and false negatives?

   • AIncrease the alert severity to 'Critical' so analysts must review every alert.
   • BRemove the download condition and alert on any PowerShell process that runs for more than 5 minutes.
   • CDisable the analytic and rely on endpoint protection to detect malicious PowerShell.
   • DAdd an allowlist for the internal server's IP and increase the threshold to require the download to be from an external domain with a high reputation score.
   Reveal Solution Discussion Select an answer first