Proactive Detection and Analysis GSOM Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A mature SOC has a well-tuned SIEM with many detection rules, but the team suspects that a sophisticated adversary may be operating under the threshold of detection. The SOC manager wants to implement a threat hunting program but has limited analyst time. Which approach best balances thoroughness with resource constraints?

   • AHunt only when a new threat intelligence report is published.
   • BUse the SIEM to generate random alerts and investigate them as hunts.
   • CConduct exhaustive hunts across all data sources every week, regardless of the threat profile.
   • DPrioritize hunts based on the MITRE ATT&CK techniques most likely to be used by the organization's threat profile, and use automated data collection to support the hunts.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC manager wants to establish a continuous improvement loop for the detection program. The team has a backlog of false-positive alerts and a list of missed detections from recent incidents. Which process would best institutionalize the feedback loop?

   • ASchedule a monthly detection review meeting where analysts review false-positive trends and missed detections, then prioritize rule updates.
   • BIncrease the alert threshold for all rules to reduce the number of false positives.
   • CWait for the next version of the SIEM to include better rules.
   • DAsk each analyst to independently update rules whenever they see a false positive.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A detection engineer is tuning a rule that detects 'suspicious PowerShell encoded command execution'. The rule has a high false-positive rate because many administrative scripts use encoded commands. Which tuning approach would best maintain detection of malicious encoded commands while reducing false positives?

   • ARemove the rule entirely and rely on manual review of PowerShell logs.
   • BSet the rule to only alert when the encoded command is longer than 1000 characters.
   • CChange the rule to alert on any PowerShell execution, regardless of encoding.
   • DAdd a condition that the encoded command contains known malicious keywords or that the parent process is a non-standard application.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security operations manager wants to reduce the average dwell time of threats in the environment. The team currently relies primarily on automated alerts from the SIEM. Which proactive detection initiative would most directly address dwell time reduction?

   • APurchase additional threat intelligence feeds and integrate them into the SIEM.
   • BImplement a regular threat hunting program that actively searches for indicators of compromise and TTPs that may not trigger automated alerts.
   • CHire more SOC analysts to manually review all alerts.
   • DIncrease the frequency of vulnerability scans from monthly to weekly.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which action is part of a continuous improvement loop for detection content?

   • ADisabling logging to reduce data volume
   • BDeleting all detection rules that have ever generated an alert
   • CReviewing false positive rates and adjusting rules accordingly
   • DIgnoring new threat intelligence to avoid changing existing rules
   Reveal Solution Discussion Select an answer first