Create and Tune Detections (i.e. Correlation Search). CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A detection engineer has made several tuning changes to a correlation search over the past month. The engineer wants to ensure that the detection remains effective and that changes are documented. Which maintenance practice is most appropriate?

   • AKeep the search unchanged to avoid introducing new issues.
   • BOnly document changes when a major incident occurs.
   • CRely on the Splunk audit log to track changes automatically.
   • DSchedule a periodic review of the detection, including alert volume and false positive rate, and update documentation accordingly.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A correlation search that runs every 5 minutes is consuming excessive resources and causing performance issues in Splunk Enterprise. The search scans a large index and uses a complex `transaction` command. The engineer needs to reduce the performance impact while maintaining timely detection. Which optimization is most effective?

   • AIncrease the search window to 24 hours and run the search hourly.
   • BMove the search to a dedicated search head and keep the same schedule.
   • CReduce the index retention period to decrease the data volume scanned.
   • DUse `stats` instead of `transaction` where possible and add a `where` clause to filter early.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is creating a correlation search to detect multiple failed login attempts followed by a successful login on the same host within a short window. The search should minimize false positives from legitimate users mistyping passwords. Which SPL approach best meets this requirement?

   • AUse `stats` to count failed attempts per user, then alert when the count exceeds 5 in any time range.
   • BUse `transaction` to group events by user and host, then filter for transactions with at least 5 failed attempts followed by a success.
   • CUse `eventstats` to compute the average failures per host and alert when the count is above average.
   • DUse `join` to combine failed and successful login events, then alert on any match.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the context of detection engineering, what is the role of a correlation search?

   • ATo provide a mechanism for detecting specific threat behaviors by correlating events across different data sources
   • BTo generate reports for management on the overall security posture
   • CTo replace the need for manual threat hunting by automatically blocking all suspicious IPs
   • DTo store raw event data in a compressed format for long-term compliance
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of a correlation search in Splunk?

   • ATo collect and index raw data from multiple sources into a single index
   • BTo visualize security metrics on a dashboard for real-time monitoring
   • CTo search across multiple data sources and identify relationships that indicate a security threat
   • DTo automatically remediate security incidents without human intervention
   Reveal Solution Discussion Select an answer first