4.1 Developing and Implementing Mechanisms to Detect Risks and Identify Threats PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   What is the primary purpose of designing detection rules to discover posture or risk profile changes?

   • ATo automatically patch all vulnerabilities
   • BTo reduce the number of security tools
   • CTo identify when the security configuration of the environment changes in a way that increases risk
   • DTo improve network performance
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is investigating a potential zero-day exploit. They have a YARA-L rule that flags processes with a low prevalence score. The rule has generated several alerts, but the team is concerned about false positives from legitimate software that is rarely used in their environment. They want to reduce false positives while still catching the zero-day. What is the best way to refine the rule?

   • AUse the entity graph to check if the process is associated with any known legitimate software.
   • BIncrease the prevalence threshold so that only very rare processes are flagged.
   • CRemove the rule and rely on threat intelligence feeds to detect the zero-day.
   • DAdd a condition to the rule that excludes processes that match a known-good list of software.
   Reveal Solution Discussion Select an answer first