Proactive Detection and Analysis GSOM Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security operations team has observed a series of alerts that, when correlated, show a pattern consistent with the MITRE ATT&CK technique T1059.001 (PowerShell). The team wants to proactively detect this technique across the environment. However, the team is concerned about false positives because PowerShell is widely used by administrators. Which approach best balances detection and false-positive reduction?

   • ADisable PowerShell on all endpoints to eliminate the risk.
   • BAlert on all PowerShell execution events.
   • CRely on antivirus signatures to detect malicious PowerShell.
   • DCreate a rule that detects PowerShell execution with specific suspicious parameters, such as -EncodedCommand or -ExecutionPolicy Bypass, and correlate with parent process anomalies.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is expanding its data source integration to improve proactive detection. They currently collect Windows event logs and firewall logs. Which additional data source would provide the most value for detecting lateral movement and privilege escalation?

   • ADNS query logs only.
   • BAuthentication logs from domain controllers and endpoint process creation logs.
   • CNetFlow data from the core switch.
   • DPhysical access logs from the building entry system.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which activity best exemplifies a structured threat hunting methodology?

   • AWaiting for an alert before investigating a suspicious process
   • BUsing a hypothesis to search for indicators of compromise across endpoints and logs
   • CReviewing a daily report of all firewall denies
   • DDeploying a new firewall rule to block known malicious IPs
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which data source is most useful for detecting lateral movement within a network?

   • ABuilding access badge swipes
   • BMarketing analytics data
   • CAuthentication logs and network connection logs
   • DHuman resources records
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations team notices that their EDR has not generated any alerts for lateral movement in the past six months, despite a mature deployment. The team suspects that attackers may be using living-off-the-land binaries (LOLBins) that the EDR does not flag. Which approach best applies a structured threat hunting methodology to investigate this gap?

   • AIncrease the EDR alert severity threshold for all process creation events to reduce noise and surface only high-confidence alerts.
   • BDeploy additional EDR sensors to every endpoint to ensure complete coverage before attempting any hunting.
   • CRun a hypothesis-driven hunt that queries process creation logs for known LOLBin execution patterns and correlates with network connections to internal hosts.
   • DReview only the EDR's built-in alert rules for LOLBins and enable any that are currently disabled.
   Reveal Solution Discussion Select an answer first