Create and Maintain a Detection Lifecycle. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is part of the monitoring and tuning phase?

   • ADefining detection requirements
   • BRetiring the detection
   • CAnalyzing alert trends to identify recurring false positives
   • DWriting the initial detection logic
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team has a detection rule that has been in production for a year. The rule has a high true positive rate, but it also generates a high volume of alerts that require manual review. The team is considering whether to tune the rule or retire it. What is the most important factor to consider in this decision?

   • AThe number of analysts available to review alerts.
   • BThe rule's severity level.
   • CThe rule's age.
   • DThe cost of tuning the rule compared to the cost of retiring it and potentially missing future attacks.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A detection engineer is developing a rule to detect credential dumping using a specific tool. The engineer has a sample of the tool's output and a sample of normal system activity. What is the best way to validate the rule during development?

   • ARun the rule only against the malicious sample to confirm it triggers.
   • BAsk a colleague to review the rule's syntax for errors.
   • CRun the rule against both the malicious sample and the normal activity to see if it correctly identifies the malicious activity and does not flag the normal activity.
   • DDeploy the rule to a test environment and wait for a real attack.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of integrating a detection with existing security tools?

   • ATesting the detection against known data
   • BReviewing threat intelligence feeds
   • CConfiguring the alert to send notifications to a ticketing system
   • DWriting the detection logic in a text editor
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When gathering requirements for a detection, which of the following is a key element to document?

   • AThe name of the detection engineer
   • BThe specific threat or attack technique to detect
   • CThe number of false positives expected
   • DThe color of the alert dashboard
   Reveal Solution Discussion Select an answer first