Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A correlation search that detects 'multiple failed logons' is generating a high volume of notable events, most of which are false positives from a legacy application that uses service accounts. The analyst wants to reduce the noise without missing real brute-force attacks. Which tuning approach is most effective?

   • ASet the correlation search to run only once per day instead of every 5 minutes.
   • BIncrease the severity of the notable events so they are more visible to analysts.
   • CDisable the correlation search and rely on manual log review for this detection.
   • DAdd a filter to the correlation search to exclude the specific service accounts used by the legacy application.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of enriching a notable event with additional context?

   • ATo make the event more informative for analysts during investigation
   • BTo reduce the storage size of the event
   • CTo delete the event from the system
   • DTo increase the event's severity automatically
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What does throttling do in the context of notable event generation?

   • AIt deletes old notable events automatically
   • BIt changes the owner of notable events
   • CIt limits the number of notable events generated for the same condition within a specified time period
   • DIt increases the severity of notable events
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A correlation search generates notable events for user account lockouts. The analyst wants to enrich each event with the user's role and location from an Active Directory lookup. The lookup file is already configured in Splunk. Which step is necessary to include the enriched fields in the notable event?

   • AManually add the role and location to each notable event in the Incident Review interface.
   • BEnable the 'Enrichment' option in the notable event action settings and select the AD lookup.
   • CCreate a new correlation search that runs after the main one and updates the notable events with the AD data.
   • DAdd the `lookup` command to the correlation search and ensure the `role` and `location` fields are included in the notable event's 'Custom Details' or 'Description'.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the goal of tuning notable event generation?

   • ATo eliminate all notable events from the system
   • BTo make notable events more complex to understand
   • CTo reduce false positives and improve detection effectiveness
   • DTo increase the number of notable events generated
   Reveal Solution Discussion Select an answer first