4.2 Leveraging Threat Intelligence for Detection PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst notices that a specific alert for 'failed logon' has fired 500 times in the last hour from the same source IP. The alert is triggered by a detection rule that flags any failed logon event. The analyst needs to determine if this is a brute-force attack or a benign issue. What is the first step the analyst should take?

   • AImmediately block the source IP address.
   • BIncrease the alert threshold to reduce the number of alerts.
   • CIgnore the alert because it is a known false positive.
   • DCalculate the frequency of the alert over a defined time window to identify the pattern.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When searching telemetry with IOCs, what type of data should the queries be run against?

   • AOnly the threat intelligence feed itself
   • BIngested security telemetry such as logs and events
   • CThe analyst's personal notes and documentation
   • DExternal public websites and forums
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A detection rule for 'suspicious process execution' is generating a large number of alerts. Investigation shows that most alerts are triggered by a legitimate software update process that runs on all workstations. The SOC wants to reduce the noise without losing visibility into malicious process execution. What is the most appropriate tuning action?

   • ADisable the rule during the software update window.
   • BIncrease the alert threshold to require multiple process executions in a short time.
   • CChange the rule to only alert on process executions from non-admin users.
   • DWhitelist the specific software update process's hash or path for this rule.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An alert contains two IOCs: one with a high risk score and one with a low risk score. According to the principle of alert prioritization using IOC scores, how should the alert be triaged?

   • AWait for additional IOCs to be added before deciding
   • BEscalate the alert because it contains at least one high-risk indicator
   • CAssign the alert a medium priority because the scores average out
   • DIgnore the alert because the low-risk IOC reduces the overall severity
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   When analyzing high-frequency alerts, what should an analyst look for to distinguish benign repetitive activity from true threats?

   • APatterns that indicate the activity is routine and expected
   • BThe number of characters in the alert ID
   • CThe color of the alert in the dashboard
   • DThe name of the analyst who created the alert rule
   Reveal Solution Discussion Select an answer first