Understand and Create Risk-Based Modifiers and Detections. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key step in testing a risk-based detection in Splunk?

   • ADeleting all existing risk scores
   • BDisabling the detection permanently
   • CRunning the detection against historical data to verify risk score changes
   • DChanging the detection's permissions to public
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A detection engineer is building a risk-based modifier that should only add risk when the event's 'dest' host is in a specific critical asset list. The engineer has a lookup file named 'critical_assets.csv' with a field 'dest'. What is the correct way to reference this lookup in the modifier's correlation search?

   • AReference the lookup file directly in the detection's 'risk_object' field to filter the risk object.
   • BUse the 'inputlookup' command to load the entire CSV into the search and then compare it to the event's 'dest' field.
   • CUse the 'lookup' command to join the event's 'dest' field with the 'critical_assets.csv' file, then filter for matches in the search.
   • DUse the 'where' command with a hardcoded list of critical asset hostnames in the search.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A detection engineer is tuning a detection that flags 'suspicious PowerShell' activity. The detection currently assigns a risk score of 20 to the 'user' risk object. The engineer wants to increase the score by 30 when the user is a 'domain_admin' and decrease it by 10 when the user is a 'standard_user'. A 'domain_admin' user triggers the detection. What is the final risk score for this user?

   • A30, because the modifier replaces the base score when it is applied.
   • B20, because the modifier only applies to the total risk score, not the individual detection's score.
   • C40, because the base score of 20 is increased by 30 and then decreased by 10 for the standard_user condition.
   • D50, because the base score of 20 is increased by 30 for the domain_admin.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When creating a risk-based modifier in Splunk, what must you specify?

   • AA list of all users in the organization
   • BThe exact timestamp of the event
   • CA new index to store risk scores
   • DA condition and a risk score adjustment
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What should you check when validating a risk-based detection?

   • AThat the detection is visible in the dashboard
   • BThat the detection runs faster than before
   • CThat the risk score for the risk object changes as expected when the detection fires
   • DThat the detection uses the least amount of memory
   Reveal Solution Discussion Select an answer first