Detection and Analysis CCOA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC is overwhelmed by a high volume of alerts, most of which are false positives. The team wants to reduce alert fatigue without missing real incidents. They have a SIEM that can ingest logs from multiple sources and support custom correlation rules. Which approach would be most effective in reducing false positives while maintaining detection capability?

   • ACreate correlation rules that require multiple conditions to be met before an alert is generated.
   • BDisable all alerts that are not associated with known threat intelligence indicators.
   • CIncrease the severity threshold for all alerts so only high-severity alerts are investigated.
   • DReduce the log sources that are ingested into the SIEM to only critical servers.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is reviewing network flow data and notices a large amount of data being transferred from a database server to an external IP address on port 443 (HTTPS). The database server is not supposed to initiate outbound connections. The external IP is not in any threat intelligence feeds. What should the analyst do first?

   • ABlock the external IP address to stop the data transfer.
   • BIgnore the traffic because the IP is not on a threat list.
   • CInitiate a packet capture to inspect the content of the HTTPS traffic.
   • DCheck the database server's logs to see which process is initiating the outbound connections.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which log source is most useful for correlating a user's activity across multiple systems?

   • AAntivirus logs
   • BFirewall logs
   • CAuthentication logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During an incident investigation, an analyst discovers that a compromised host communicated with an external IP address that is listed in a threat intelligence feed as a command-and-control (C2) server. The analyst also notices that the host made DNS queries for a domain that is algorithmically generated. Which combination of indicators provides the strongest evidence of a coordinated attack?

   • AThe combination of the known C2 IP and the DGA domain, because they both point to the same malicious infrastructure and behavior.
   • BThe DNS queries alone, because algorithmically generated domains are a clear sign of malware.
   • CThe external IP address alone, because it is a known C2 server.
   • DThe fact that the host is a compromised host, because that is the primary indicator.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An analyst receives an alert from a SIEM indicating a high number of failed logins. What is the first step in validating this alert?

   • AIgnore the alert if it is from a non-critical system
   • BEscalate the alert to senior management
   • CImmediately block the source IP address
   • DCheck the raw logs to confirm the alert is based on accurate data
   Reveal Solution Discussion Select an answer first