Analytic Design and Tuning GSOC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team is developing a use case to detect 'account takeover' based on anomalous login locations. They have VPN logs, SSO authentication logs, and endpoint logs. The team wants to minimize false positives for remote workers who travel frequently. Which analytic design best meets the requirement?

   • AAlert on any login that fails geolocation lookup.
   • BAlert on any login that occurs outside business hours.
   • CAlert on any login from a country not in the employee's home country.
   • DAlert on logins that occur from a new device and a new location within a short time window, using a risk score.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC's analytic for 'privilege escalation' only alerts when a standard user adds themselves to the local Administrators group. The team discovers that attackers are using a different technique: they modify a service's binary path to run a malicious executable with SYSTEM privileges. This activity is not being detected. What is the best way to reduce this false negative?

   • AIncrease the frequency of the existing analytic to run every minute.
   • BRely on the endpoint protection tool to detect service modifications.
   • CAdd a new analytic that monitors changes to service configuration, specifically the 'ImagePath' or 'BinaryPathName' value, and alerts on modifications to critical services.
   • DModify the existing analytic to alert on any change to the local Administrators group, including adding or removing users.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An analyst is designing an analytic to detect unauthorized access attempts to a critical application. Which data source would be MOST relevant for this purpose?

   • AApplication authentication logs
   • BEndpoint antivirus logs
   • CDNS query logs
   • DFirewall logs
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When a security analytic is significantly changed, what is the best practice for communicating the change to stakeholders?

   • ASend a brief email to the security team only
   • BWait until the next quarterly meeting to mention the change
   • CUpdate the documentation and notify all relevant stakeholders, including analysts and management
   • DMake the change silently to avoid unnecessary attention
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a primary consideration for optimizing the performance of a security analytic?

   • AThe efficiency of the query in terms of resource usage
   • BThe severity level assigned to the alert
   • CThe color scheme of the alert dashboard
   • DThe number of analysts who will review the alerts
   Reveal Solution Discussion Select an answer first