Understand and Create Risk-Based Modifiers and Detections. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A detection engineer has a detection that assigns a risk score of 10 to the 'user' risk object for 'failed logon' events. The engineer wants to add a modifier that increases the score by 20 when the user is a 'domain_admin' and decreases it by 5 when the user is a 'standard_user'. A 'standard_user' triggers the detection. What is the final risk score for this user?

   • A5, because the base score of 10 is decreased by 5 for the standard_user.
   • B20, because the modifier replaces the base score when it is applied.
   • C10, because the modifier only applies to the total risk score, not the individual detection's score.
   • D25, because the base score of 10 is increased by 20 and then decreased by 5.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A detection for 'possible credential dumping' is generating false positives for a specific set of legitimate administrative tools. The detection engineer wants to reduce the risk score contribution for these tools without disabling the detection entirely. The risk object is 'user'. What is the most effective way to achieve this?

   • ACreate a risk-based modifier that subtracts a fixed amount from the risk score when the process name matches the known legitimate tools.
   • BAdd the legitimate tools to the detection's 'notable' suppression list so they do not create notable events.
   • CIncrease the detection's base risk score so that the false positives are less noticeable relative to the true positives.
   • DChange the risk object from 'user' to 'process' so that the legitimate tools are tracked separately.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a common use of risk-based modifiers in tuning detections?

   • ATo increase the risk score for high-value assets
   • BTo disable detections that generate too many alerts
   • CTo change the detection's search time range
   • DTo add new data sources to the detection
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A SOC manager is reviewing the risk scores for a 'user' who triggered two detections: one for 'credential theft' with a score of 40 and one for 'lateral movement' with a score of 30. The manager wants to know the user's total risk score to decide if they should be escalated. What is the total risk score for this user?

   • A40, because the highest score is used to prioritize the user.
   • B70, because risk scores from multiple detections are summed for the same risk object.
   • CThe total cannot be determined because the scores are tracked separately.
   • D35, because the average of the scores is used to prioritize the user.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the effect of applying a risk-based modifier to a detection?

   • AIt adjusts the risk score assigned to the risk object when the detection fires
   • BIt changes the detection's search schedule
   • CIt changes the detection's output format
   • DIt suppresses the detection from generating alerts
   Reveal Solution Discussion Select an answer first