Identify High Value / High Signal / High Noise Data Sources (e.g. Windows Process vs EDR Process Flow, or network/VPC Flow vs Packet Capture) and How They Support Security Operations Use Cases. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst is reviewing alerts and notices that a particular data source generates a high number of alerts that are rarely related to actual security incidents. The analyst wants to improve the signal-to-noise ratio of their monitoring. What should the analyst do?

   • AIncrease the volume of data collected from that source
   • BIgnore all alerts from that source
   • CCreate a correlation search that filters out known false positives
   • DRemove the data source from the SIEM entirely
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which data source is most appropriate for a security operations use case that requires deep investigation of a specific malware infection, including the exact commands executed?

   • ANetwork flow logs
   • BDNS logs
   • CEDR process flow data
   • DVPC flow logs
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization is deploying a new detection use case to identify malicious PowerShell usage. The security team wants to minimize false positives while ensuring they capture suspicious activity. They have access to both Windows PowerShell operational logs and EDR telemetry that includes script block logging. Which data source should be the primary basis for this detection?

   • ASysmon event logs
   • BEDR telemetry with script block logging
   • CWindows PowerShell operational logs
   • DWindows Security Event logs (4688)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which scenario best illustrates the problem of a high noise data source?

   • AA firewall log that records every allowed and denied connection, including routine web browsing.
   • BA domain controller log that only records successful and failed logon events.
   • CAn EDR log that records process creation, network connections, and file changes on endpoints.
   • DA cloud audit log that records only administrative actions on critical resources.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team is implementing a new detection for data exfiltration. They have access to both DNS logs and full packet capture. The team wants to minimize false positives while detecting DNS tunneling. Which data source would provide the highest signal for this detection?

   • ANetFlow logs
   • BFull packet capture (PCAP)
   • CWindows event logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first