Create and Tune Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which indexing consideration can improve the performance of a correlation search?

   • AEnsuring that the search references the correct index and uses indexed fields in the search
   • BUsing a single index for all data types to simplify search
   • CStoring all data in a single bucket to reduce fragmentation
   • DDisabling index-time field extraction to save storage
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A correlation search for 'possible brute force' uses a static threshold of 20 failed logins per hour. The environment has a mix of systems: some are internet-facing with high login traffic, others are internal with low traffic. The search generates many false positives on internet-facing systems and misses attacks on internal systems. The engineer wants to improve accuracy without increasing operational overhead significantly. Which approach is most effective?

   • AImplement a per-asset baseline that calculates the average failed logins and alerts when the count exceeds 3 standard deviations above the mean.
   • BIncrease the search window to 24 hours and alert on any count above 20.
   • CSet a single threshold of 50 failed logins per hour for all systems.
   • DDisable the search for internet-facing systems and keep the threshold for internal systems.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A detection engineer is tuning a correlation search for 'possible data exfiltration' that alerts on large outbound transfers. The search currently uses a static threshold of 1 GB per hour, but it generates many false positives from a backup server that routinely transfers 5 GB hourly. The engineer wants to reduce false positives without missing real exfiltration from other hosts. Which tuning action is most effective?

   • ADisable the search and rely on manual review of network logs.
   • BChange the search to alert only when the transfer exceeds 1 GB and lasts more than 30 minutes.
   • CCreate an allowlist for the backup server and keep the threshold at 1 GB for other hosts.
   • DIncrease the threshold to 10 GB per hour for all hosts.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A correlation search for 'multiple failed logins' is generating too many alerts from a specific application that uses service accounts with predictable retry patterns. The engineer wants to reduce these false positives without affecting detection for real user accounts. Which tuning action is most appropriate?

   • AAdd a condition to exclude events where the username matches known service accounts.
   • BAdd a time-of-day filter to only alert during business hours.
   • CIncrease the threshold for all users to reduce overall alert volume.
   • DDisable the search and create a new one for service accounts only.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A detection engineer has developed a correlation search to detect 'pass-the-hash' attacks. The engineer wants to validate the detection before deployment. The team has a dataset of known-good authentication events and a dataset of known-bad pass-the-hash events. The engineer runs the search on both datasets and observes that it alerts on all known-bad events but also alerts on 5% of known-good events. Which action is most appropriate?

   • ADeploy the search as-is because it detects all known-bad events.
   • BDisable the search and use a commercial threat intelligence feed instead.
   • CTune the search to reduce false positives by adding additional constraints or exceptions, then re-validate on both datasets.
   • DIncrease the threshold to reduce false positives, even if it means missing some known-bad events.
   Reveal Solution Discussion Select an answer first