Create and Maintain a Detection Lifecycle. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A detection engineer is deploying a new rule that uses a script to enrich alerts with threat intelligence data. The script is stored on a server that is occasionally unavailable. What should the engineer do to ensure the detection remains effective?

   • AIncrease the rule's time range to compensate for the script's downtime.
   • BConfigure the rule to still generate alerts even if the enrichment script fails.
   • CDisable the rule until the script is guaranteed to be available.
   • DMove the script to a more reliable server before deploying the rule.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team has a detection rule that has been in production for a year. The rule's true positive rate is high, but it also generates a significant number of false positives. The team has limited analyst time. What is the most appropriate action?

   • ATune the rule to reduce false positives while maintaining true positive detection.
   • BRetire the rule because it generates too many false positives.
   • CIncrease the rule's severity to prioritize its alerts.
   • DDisable the rule until the false positive rate decreases.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team has a detection rule that was created three years ago to detect a specific malware family. The malware is no longer active, and the rule has not generated an alert in over a year. According to the detection lifecycle, what should the team do?

   • AIncrease the rule's severity to ensure it is noticed if it fires.
   • BModify the rule to detect a different malware family.
   • CRetire the rule and document the reason for its retirement.
   • DKeep the rule active in case the malware reappears.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is tasked with detecting data exfiltration via DNS. They have access to DNS logs and threat intelligence about known malicious domains. What is the most important requirement to define before developing the detection?

   • AThe specific DNS query patterns that indicate exfiltration, such as long subdomains or high query volume to a single domain.
   • BThe number of DNS servers in the environment.
   • CThe version of the DNS server software.
   • DThe cost of the threat intelligence feed.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a typical detection lifecycle, which phase immediately follows the initial hypothesis and precedes the development of the detection logic?

   • ARetirement
   • BRequirements gathering
   • CDeployment
   • DMonitoring and tuning
   Reveal Solution Discussion Select an answer first