4.2 Leveraging Threat Intelligence for Detection PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When applying a risk-based scoring scheme to IOCs, what is the primary purpose of assigning a risk level to each indicator?

   • ATo automatically block all IOCs with a medium or higher score
   • BTo determine the exact remediation steps for every incident
   • CTo replace the need for human analysis of all alerts
   • DTo prioritize alerts based on the potential severity of the associated threat
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A threat intelligence feed has just published a new set of IOCs. To identify potential threats in your environment, what should you do with these IOCs?

   • AStore them in a spreadsheet for future reference without querying
   • BWait for the next scheduled feed update before using them
   • CUse them to construct and execute queries against ingested security telemetry
   • DManually review each IOC against a single log file
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of alert tuning to reduce false positives?

   • ADisabling the alert rule entirely
   • BDeleting all logs that triggered the alert
   • CIncreasing the severity of the alert to attract more attention
   • DAdjusting the threshold so the alert only fires when activity exceeds a certain count
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   Your organization uses a SIEM that ingests logs from multiple sources. A threat intelligence feed provides IOCs with risk scores. You need to search for a newly published high-risk IOC (a domain) across your telemetry. The IOC feed is updated every 15 minutes. You have a detection rule that queries DNS logs for domains from the IOC feed. However, you notice that the rule is not matching any events, even though you know the domain is active. What is the most likely cause?

   • AThe domain is not present in the DNS logs because no host has resolved it.
   • BThe detection rule is using a cached version of the IOC feed that has not been updated with the new domain.
   • CThe DNS logs are not being ingested into the SIEM.
   • DThe rule is querying proxy logs instead of DNS logs.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A detection rule for 'multiple failed logons followed by success' is generating a large number of alerts. Analysis shows that most alerts are triggered by a legacy application that retries authentication with a service account, which often fails several times before succeeding. The SOC wants to reduce the noise without missing real brute-force attacks. What is the best tuning action?

   • AIncrease the number of failed logons required to trigger the alert.
   • BAdd the legacy application's service account to a whitelist for this rule.
   • CChange the rule to only alert on failed logons without a subsequent success.
   • DDisable the rule during business hours when the legacy application is active.
   Reveal Solution Discussion Select an answer first