Create and Maintain a Detection Lifecycle. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A detection engineer is deploying a new rule that requires a specific data model to be populated. The data model is not yet fully populated in the production environment. What should the engineer do?

   • AModify the rule to use raw logs instead of the data model.
   • BDeploy the rule anyway and rely on the data model to be populated soon.
   • CDeploy the rule and set it to run only during off-peak hours.
   • DWait until the data model is fully populated before deploying the rule.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which input is most important when defining detection requirements for a new alert?

   • AThe number of existing alerts
   • BThreat intelligence and business context
   • CThe analyst's personal preference
   • DThe detection's deployment date
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which activity is part of the detection development process?

   • AWriting the detection logic (e.g., SPL or correlation search)
   • BDefining business context
   • CRetiring outdated detections
   • DMonitoring alert volumes in production
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations team is planning to implement a new detection for a specific threat actor group that has been observed using a particular command-line obfuscation technique. The team has access to threat intelligence reports and historical endpoint data. Which approach best aligns with the detection lifecycle's requirements-gathering phase?

   • ASearch the SIEM for historical alerts from the past year to see if the technique has triggered any existing rules.
   • BAsk the threat intelligence team to provide a list of all known command-line obfuscation techniques and then implement rules for each one.
   • CDefine the detection's purpose, identify relevant data sources, and document the expected behavior and potential impact before writing any rule logic.
   • DWrite the detection rule immediately based on the threat intelligence report and deploy it to production.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team has a detection rule that has been in production for six months. The rule's false positive rate has increased significantly after a recent software update. What is the most appropriate action?

   • ADisable the rule until the software vendor releases a fix.
   • BImmediately retire the rule because it is no longer effective.
   • CAnalyze the recent alerts to identify the common cause of the false positives and adjust the rule accordingly.
   • DIncrease the rule's threshold to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first