Create and Maintain a Detection Lifecycle. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of testing a detection against known data during the development process?

   • ATo increase the number of alerts generated
   • BTo determine the deployment date
   • CTo validate that the detection correctly identifies the intended activity
   • DTo replace threat intelligence feeds
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a valid criterion for retiring an outdated detection?

   • AThe detection has generated too many alerts
   • BThe detection is not integrated with a ticketing system
   • CThe detection was created more than a year ago
   • DThe detection no longer addresses a relevant threat or security gap
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is it important to conduct periodic reviews of detections?

   • ATo ensure detections remain relevant and effective over time
   • BTo delete all detections that are not generating alerts
   • CTo change the detection's primary concept
   • DTo increase the number of detections
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A detection engineer has written a new Splunk search to detect suspicious PowerShell activity. Before deploying it, the engineer wants to validate the rule's effectiveness. Which action is most appropriate for this stage of the detection lifecycle?

   • ARun the search against a sample of known malicious and benign PowerShell commands to measure true and false positive rates.
   • BCheck the rule against the MITRE ATT&CK framework to ensure it maps to a known technique.
   • CReview the rule's syntax with a peer to ensure it is correct.
   • DDeploy the rule to production immediately and monitor the alert volume for a week.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security team is tasked with improving detection for insider threats. They have access to HR data (e.g., employee termination dates) and Active Directory logs. Which requirement is most important to define before developing the detection?

   • AThe specific user behaviors that indicate a potential insider threat, such as mass file deletion or unusual after-hours access.
   • BThe version of Windows Server used by the domain controllers.
   • CThe number of security analysts available to investigate alerts.
   • DThe cost of the Splunk license required to ingest HR data.
   Reveal Solution Discussion Select an answer first