Create and Tune Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A detection engineer has been tuning a correlation search for several months. The search has been modified multiple times, and the engineer is concerned that the detection may have drifted from its original intent. The engineer wants to ensure the detection remains effective and that changes are documented. Which maintenance practice is most appropriate?

   • ARely on the Splunk audit log to track changes automatically.
   • BOnly document changes when a major incident occurs.
   • CConduct a periodic review of the detection, including alert volume, false positive rate, and comparison to the original use case, and update documentation.
   • DKeep the search unchanged to avoid introducing new issues.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of versioning a correlation search?

   • ATo ensure the search runs on the latest version of Splunk
   • BTo automatically schedule the search at different times
   • CTo track changes and allow rollback to previous versions if needed
   • DTo reduce the number of false positives by storing multiple versions
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A correlation search alerts on 'unusual number of failed logins' using a static threshold of 10 failures per hour. The environment has a mix of high-traffic and low-traffic systems, causing many false positives on busy systems and false negatives on quiet ones. The engineer wants to improve accuracy. Which approach is most effective?

   • AIncrease the search window to 24 hours and alert on any failures above 10.
   • BUse a baseline that calculates the average failures per system and alert when the count exceeds 3 standard deviations above the mean.
   • CDisable the search for low-traffic systems and keep the threshold for high-traffic ones.
   • DSet a single threshold of 50 failures per hour to reduce false positives on busy systems.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A detection engineer is tuning a correlation search that alerts on excessive outbound data transfers. The search currently uses a static threshold of 100 MB per hour, but it generates many false positives for a backup server that routinely transfers 500 MB hourly. The engineer wants to reduce noise without missing real exfiltration. Which approach is most effective?

   • AChange the search to alert only when the transfer exceeds 100 MB and lasts more than 10 minutes.
   • BCreate an allowlist for the backup server and keep the threshold at 100 MB for other hosts.
   • CIncrease the threshold to 1 GB per hour for all systems.
   • DDisable the search and rely on manual review of network logs.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When setting a threshold for a correlation search that detects brute-force attacks, what is the primary goal of establishing a baseline?

   • ATo ensure the search runs quickly by limiting the data it processes
   • BTo identify the specific user accounts that are most likely to be targeted
   • CTo comply with regulatory requirements for logging authentication failures
   • DTo determine the normal level of failed authentication attempts so the threshold can be set above that level
   Reveal Solution Discussion Select an answer first