Create and Tune Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A detection engineer is designing a correlation search to detect data exfiltration via DNS tunneling. The search should identify unusually long DNS queries or a high volume of DNS requests to a single domain. Which SPL logic best captures both behaviors?

   • AUse `lookup` to compare against a known malicious domain list and alert on matches.
   • BUse `regex` to extract domain names and alert on any domain with more than 10 subdomains.
   • CUse `eval` to calculate query length and `stats` to count queries per domain, then alert when length exceeds 100 characters or count exceeds 1000.
   • DUse `transaction` to group all DNS queries per client and alert on any transaction longer than 5 minutes.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A correlation search that runs every hour is taking 30 minutes to complete, causing delays in alerting. The search scans a large index and uses multiple `join` commands. The engineer needs to reduce the search time while maintaining detection accuracy. Which optimization is most effective?

   • ARun the search on a smaller index that contains only relevant events.
   • BReplace `join` commands with `stats` and `eventstats` where possible.
   • CReduce the search frequency to every 4 hours.
   • DIncrease the search window to cover more data.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A detection engineer has created a correlation search to detect lateral movement using remote service creation. The engineer wants to validate the detection against a known attack technique. Which validation step is most appropriate?

   • AReplay a known attack dataset containing the technique and confirm the search generates an alert.
   • BRun the search on live production data and review any alerts for relevance.
   • CCompare the search to a similar one from the Splunk community.
   • DAsk another engineer to review the SPL for syntax errors.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A correlation search for suspicious PowerShell usage generates alerts for a known administrative script that runs daily. What is the most appropriate tuning action?

   • AAdd an exception for the specific script name or hash to the search
   • BChange the search to only look for PowerShell usage from non-admin users
   • CIncrease the search schedule to run less frequently
   • DDelete the correlation search and create a new one from scratch
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which SPL command is most appropriate to detect a single user account failing to authenticate more than five times within a 10-minute window?

   • Aindex=auth | bucket _time span=10m | stats count by user, _time | where count > 5
   • Bindex=auth | where count > 5 | stats count by user
   • Cindex=auth | stats count by user | where count > 5
   • Dindex=auth | stats count by user | where count > 5 | timechart span=10m count
   Reveal Solution Discussion Select an answer first