Proactive Detection and Analysis GSOM Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A threat hunt is being planned to look for 'living off the land' attacks that use native Windows tools like PowerShell and WMI. The team has a hypothesis that attackers are using WMI to execute commands remotely. Which data source would be most valuable to test this hypothesis?

   • AWindows Event Logs for WMI activity (Event ID 5857 and 5858) and process creation events (4688) on target systems.
   • BFirewall logs showing inbound connections to port 445.
   • CDHCP logs for IP address assignments.
   • DDNS logs for queries to external domains.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is integrating multiple data sources important for proactive detection?

   • AIt provides a comprehensive view of activity across the environment to uncover hidden threats
   • BIt guarantees that all attacks will be detected automatically
   • CIt reduces the need for skilled security analysts
   • DIt allows the SOC to store more data for compliance purposes only
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A detection engineering team has implemented a new rule that detects unusual outbound connections. After two weeks, the rule has produced 200 alerts, but only 5 were confirmed as malicious. The team wants to improve the rule's precision. Which action is most aligned with the continuous improvement loop?

   • AKeep the rule as is because 5 true positives are valuable.
   • BDisable the rule and rely on manual log review.
   • CIncrease the alert threshold to reduce the number of alerts, regardless of the cause.
   • DAnalyze the false positives to identify common benign patterns, then add exceptions or modify the rule logic accordingly.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security team is planning a proactive hunt for data exfiltration. They have firewall logs and DNS logs, but they suspect that attackers may be using encrypted tunnels over HTTPS. Which additional data source would most directly improve their ability to detect this activity?

   • AProxy logs that include the full URL and TLS SNI for outbound connections.
   • BNetFlow records that only include source and destination IP and port.
   • CWindows Event Logs for successful logon events.
   • DDHCP lease logs to track which IP address was assigned to which device.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which activity is a core part of detection engineering?

   • AWriting and testing detection rules based on known adversary behaviors
   • BPerforming forensic analysis on a compromised hard drive
   • CConfiguring firewall rules to block all inbound traffic
   • DConducting user awareness training sessions
   Reveal Solution Discussion Select an answer first