Understand and Create Risk-Based Modifiers and Detections. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations center (SOC) is overwhelmed by a high volume of low-severity alerts from a detection that flags any user who downloads more than 500 MB of data in an hour. The team wants to keep the detection but ensure that only users with a history of risky behavior are escalated for investigation. The risk object is 'user'. Which approach should the detection engineer take?

   • ASuppress the detection entirely and rely on a separate correlation search to identify large downloads.
   • BChange the risk object from 'user' to 'source_ip' so that the risk score is aggregated by IP address instead.
   • CIncrease the detection's risk score from low to critical so that every match is treated as high priority.
   • DCreate a risk-based modifier that adds a risk score only when the user's existing risk score exceeds a threshold, and apply it to the detection.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which Splunk feature is used to create risk-based modifiers?

   • ARisk-Based Alerting (RBA)
   • BWorkflow Actions
   • CData Models
   • DLookups
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How can risk-based modifiers help reduce false positives in detections?

   • ABy lowering the risk score for events that match known benign conditions
   • BBy changing the detection's severity level
   • CBy automatically deleting false positive events
   • DBy increasing the risk score for all events
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a 'risk object' in Splunk's risk-based alerting?

   • AA specific threat actor or malware family
   • BA type of correlation search
   • CAn entity, such as a user or asset, that is assigned a risk score
   • DA dashboard that displays risk scores
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A detection engineer has created a risk-based modifier that adds 40 to the risk score for a 'user' when a specific malware signature is detected. In testing, the engineer notices that the risk score is being added twice for a single event. The event is a single log entry that matches the signature. What is the most likely cause of the double-counting?

   • AThe detection's base risk score is 40 and the modifier is also adding 40, resulting in a total of 80.
   • BThe modifier's correlation search is producing multiple risk events for the same source event because the search is not deduplicating by a unique event identifier.
   • CThe modifier is configured to run on both the 'risk' index and the 'notable' index, causing it to process the event twice.
   • DThe risk object is set to 'user' but the event contains multiple 'user' fields, causing the modifier to attribute risk to each user.
   Reveal Solution Discussion Select an answer first