Analytic Design and Tuning GSOC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An analytic that detects 'pass-the-hash' activity is producing both false positives and false negatives. The false positives come from a legitimate application that uses the same NTLM hash for multiple logons. The false negatives occur because the analytic only looks at a single event ID, and some attacks use a different event ID. The team must improve the analytic without increasing the alert volume significantly. Which approach is best?

   • ARemove the analytic and rely on endpoint detection and response (EDR) alerts.
   • BAdd the second event ID and exclude the legitimate application's account from the analytic.
   • CIncrease the threshold for the number of logons within a time window.
   • DCreate two separate analytics: one for each event ID, each with its own threshold.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analytic that alerts on 'new local admin accounts created on workstations' is generating false positives because IT support uses a script that temporarily creates and deletes local admin accounts during maintenance. The team wants to reduce false positives without missing real persistence. Which tuning action is most effective?

   • ADisable the analytic and rely on manual audits of local admin accounts.
   • BExclude all accounts created by the IT support script from the analytic.
   • CIncrease the severity of the alert so analysts investigate more thoroughly.
   • DAdd a condition that the account must persist for more than 24 hours before alerting.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A SOC has tuned an analytic to reduce false positives, but the change also reduces the alert's severity from 'High' to 'Medium'. The incident response team relies on severity to prioritize alerts. What is the most important action to take?

   • AChange the analytic's name to reflect the new severity.
   • BKeep the severity change silent to avoid confusing the incident response team.
   • CRevert the severity to 'High' to maintain the original prioritization.
   • DDocument the severity change in the analytic's change log and notify the incident response team about the new severity and the reason for the change.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC runs a complex analytic that joins firewall logs with Active Directory account data to detect 'impossible travel' logins. The query takes over 10 minutes to run and times out, causing missed detections. The team needs to improve performance without losing detection capability. Which approach is best?

   • APre-aggregate the firewall logs by user and hour, then join with AD data only for users who appear in multiple locations.
   • BIncrease the SIEM query timeout to 30 minutes.
   • CRemove the AD join and alert on any login from two different countries within 24 hours.
   • DRun the analytic only once per day during off-peak hours.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team is developing a use case to detect 'data exfiltration via DNS tunneling'. They have access to DNS query logs, firewall logs, and NetFlow. The team wants to minimize the number of alerts while still detecting the technique. Which analytic approach best fits the use case?

   • AAlert on any DNS query that occurs after business hours.
   • BAlert on DNS queries that are significantly larger than the average query size for the same domain.
   • CAlert on any DNS query that resolves to an IP address outside the corporate network.
   • DAlert on any DNS query to a domain that is not on the corporate allowlist.
   Reveal Solution Discussion Select an answer first