Proactive Detection and Analysis GSOM Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A SOC manager notices that a detection rule for 'suspicious PowerShell' has a very high false-positive rate because many administrative scripts use PowerShell legitimately. The team wants to improve alert fidelity without missing real attacks. Which action best aligns with detection engineering principles?

   • AAdd more data sources, such as DNS logs, but keep the rule unchanged.
   • BIncrease the alert severity so analysts pay more attention to every alert.
   • CRefine the rule to include additional context, such as parent process, command-line patterns, and execution policy bypass, then test it against historical data.
   • DDisable the rule entirely to eliminate false positives and rely on manual log review.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is a common attack pattern associated with credential dumping?

   • AScanning for open ports on the internet
   • BEncrypting files and demanding ransom
   • CAccessing the Security Account Manager (SAM) database or LSASS process memory
   • DSending phishing emails to multiple users
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A threat hunting team is planning a hunt for a specific adversary group that is known to use WMI for lateral movement and to avoid writing files to disk. The team has access to WMI activity logs, network connection logs, and threat intelligence on the group's infrastructure. Which hunt design is most likely to uncover the adversary's activity?

   • AReview only network logs for connections to known adversary infrastructure.
   • BBlock WMI on all endpoints to prevent lateral movement.
   • CSearch for WMI process creation events on remote hosts and correlate them with network connections to known adversary infrastructure.
   • DSearch for any file creation events on endpoints.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is a key characteristic of a structured threat hunting process?

   • AIt focuses exclusively on analyzing network traffic without endpoint data.
   • BIt uses a repeatable, hypothesis-driven approach to search for threats.
   • CIt is performed only after a confirmed breach is announced.
   • DIt relies solely on automated alerting to trigger investigations.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team is building a detection rule for 'pass-the-hash' attacks. They have Windows Security Event Logs, but they are unsure which specific event IDs to use. Which data source integration would provide the most relevant evidence for this attack pattern?

   • AEnable auditing for file access events (Event ID 4663) to track access to sensitive files.
   • BEnable auditing for logon events (Event ID 4624) and logon type 3 (network logon) to identify anomalies in NTLM authentication.
   • CEnable auditing for process creation (Event ID 4688) with command-line logging.
   • DEnable auditing for account management events (Event ID 4720) to track new user creation.
   Reveal Solution Discussion Select an answer first