Proactive Detection and Analysis GSOM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which input is most valuable when formulating a hypothesis for proactive analysis?

   • AThe latest threat intelligence and knowledge of the organization's environment
   • BThe vendor's marketing materials for security products
   • CThe personal preferences of the security analyst
   • DThe number of open tickets in the ticketing system
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations manager is explaining the value of proactive detection to senior leadership. Which statement best describes the primary benefit of proactive detection compared to reactive detection?

   • AIt guarantees that all threats will be detected before they cause damage.
   • BIt eliminates the need for automated alerting and SIEM correlation rules.
   • CIt focuses primarily on responding to alerts after they are generated.
   • DIt reduces dwell time by identifying threats that may not trigger automated alerts.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A detection rule for 'suspicious scheduled task creation' has a high true-positive rate but also generates many alerts for legitimate IT automation tasks. The team wants to reduce the operational burden without losing detection of malicious tasks. Which action is most appropriate?

   • AChange the rule to alert only on scheduled tasks that run as SYSTEM.
   • BIncrease the alert severity to force immediate investigation of every alert.
   • CDelete the rule and rely on manual review of scheduled tasks on critical servers.
   • DCreate an allowlist of known IT automation task names and paths, and suppress alerts for those while keeping the rule active for everything else.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A threat intelligence report indicates that a specific adversary group is known to use scheduled tasks to maintain persistence and to exfiltrate data via HTTPS to a set of domains. The SOC wants to proactively hunt for this activity. Which hypothesis-driven approach is most effective?

   • AWait for the next automated alert from the SIEM before taking action.
   • BDisable scheduled tasks on all endpoints to prevent persistence.
   • CReview all firewall logs for any HTTPS traffic to external domains.
   • DSearch for newly created scheduled tasks on endpoints and correlate any associated network connections to the reported domains.
   Reveal Solution Discussion Select an answer first
6. 35expert · medium

   A SOC manager is reviewing the detection program's metrics and finds that the false-positive rate has increased by 30% over the last quarter, while the true-positive rate has remained flat. The team is spending more time triaging alerts. Which action would best address the root cause and improve the detection program?

   • AAdd more threat intelligence feeds to the SIEM to improve the context of alerts.
   • BIncrease the alert severity for all rules to ensure analysts prioritize the most important alerts.
   • CReduce the log retention period to decrease the volume of data being analyzed.
   • DConduct a review of the detection rules that generate the most false positives, and tune or retire them based on the findings.
   Reveal Solution Discussion Select an answer first