Proactive Detection and Analysis GSOM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A threat hunter has a hypothesis that an adversary is using PowerShell to download and execute payloads in memory. The hunter has access to PowerShell script block logs, network connection logs, and threat intelligence on known malicious domains. Which combination of data and analysis would most effectively test this hypothesis?

   • ACorrelate PowerShell script block logs that contain download cradle patterns with network connections to domains that match threat intelligence indicators.
   • BSearch for any PowerShell execution on all endpoints.
   • CBlock all PowerShell execution to prevent the attack.
   • DReview only network logs for connections to known malicious domains.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is conducting a threat hunt for 'data staging' before exfiltration. They have access to endpoint logs, network flow logs, and file integrity monitoring (FIM) logs. Which combination of data would be most effective to identify staging behavior?

   • ACorrelate FIM alerts of large numbers of files being copied to a single directory with network flows showing large outbound transfers from that host.
   • BCorrelate DNS queries with firewall logs to identify connections to known bad domains.
   • CCorrelate vulnerability scan results with patch management logs to identify unpatched systems.
   • DCorrelate logon events with process creation events to identify unusual administrative activity.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A detection engineer is developing a rule to detect suspicious use of scheduled tasks for persistence. The rule must avoid alerting on the many legitimate scheduled tasks that run regularly. The engineer has access to scheduled task creation logs and process execution logs. Which rule design is most effective?

   • AAlert on scheduled task creations that are followed by the execution of a process that is not the task's registered action, or that run from unusual paths.
   • BAlert on scheduled tasks that have been modified after creation.
   • CAlert on all new scheduled task creations.
   • DAlert on scheduled tasks that run during off-hours.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A detection engineer is designing a rule to detect credential dumping on Windows endpoints. The rule currently triggers on the presence of 'lsass.exe' in process access events, but it generates many false positives because legitimate security tools also access lsass. Which enhancement would best improve the rule's fidelity?

   • ARemove the rule entirely and rely on antivirus alerts.
   • BChange the rule to alert on any process that loads lsass.exe into memory.
   • CAdd a filter to exclude known security tools and require specific access flags, such as PROCESS_VM_READ, in the rule.
   • DIncrease the rule's severity to ensure analysts investigate every alert.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary goal of tuning detection rules in detection engineering?

   • ATo increase the volume of alerts generated by the SIEM
   • BTo improve alert fidelity by reducing false positives while maintaining true positives
   • CTo make detection rules more complex so that only senior analysts can understand them
   • DTo ensure that all alerts are automatically resolved without analyst review
   Reveal Solution Discussion Select an answer first