Analytic Design and Tuning GSOC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC has developed a new analytic to detect 'credential dumping' using event logs. Before deploying it to production, the team wants to validate that it works correctly and does not generate excessive false positives. Which validation approach is most appropriate?

   • ARun the analytic in a lab with synthetic data that perfectly matches the expected attack pattern.
   • BRun the analytic against a week of historical logs and compare the alerts with known incidents and benign activity.
   • CAsk the SIEM vendor to confirm the query syntax is correct.
   • DDeploy the analytic directly to production and monitor the alert volume for a week.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common method to improve the performance of a security analytic?

   • AAdding more data sources
   • BIndexing the fields used in the query
   • CIncreasing the alert threshold
   • DUsing a longer time window
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analytic that alerts on 'new local admin account created' is producing many false positives because the IT team routinely creates local admin accounts for troubleshooting. The SOC wants to reduce false positives without missing genuinely malicious account creation. Which approach is most effective?

   • ADisable the analytic and rely on manual review of security logs.
   • BChange the analytic to alert only when the account is added to the Administrators group.
   • CMaintain an allowlist of known IT admin accounts and alert only when an account is created that is not on the list.
   • DIncrease the alert severity so analysts pay more attention to each alert.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team is designing an analytic to detect internal reconnaissance using port scans. They have access to firewall logs, NetFlow records, and endpoint EDR telemetry. The team wants to minimize the analytic's load on the SIEM while still detecting the behavior. Which data source should the team prioritize?

   • ANetFlow records, because they provide a compact summary of all connection attempts without the verbosity of full packet captures.
   • BFull packet captures, because they provide the most complete evidence of the scan pattern.
   • CFirewall logs, because they contain the destination IP and port for every blocked connection attempt.
   • DEDR telemetry, because it shows the actual process initiating the scan and can be correlated with other endpoint activity.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC analyst tunes an analytic to reduce false positives by excluding a specific internal application's traffic. After the change, the SOC manager notices a drop in alerts and asks why. What should the analyst do?

   • ASend an email only to the SOC manager explaining the change.
   • BUpdate the analytic's documentation and notify the SOC team via the change log.
   • CExplain the change verbally to the manager and move on.
   • DRevert the change because the manager questioned it.
   Reveal Solution Discussion Select an answer first