Understand and Create Risk-Based Modifiers and Detections. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A detection engineer has just created a new risk-based modifier that adds 30 to the risk score for a 'user' when a specific threat-intel match occurs. Before deploying it to production, the engineer wants to validate that the modifier behaves as intended. What is the most appropriate validation step?

   • ACreate a test detection that uses the modifier and verify that it generates a notable event for a known threat-intel match.
   • BReview the modifier's configuration in the UI to ensure the risk score is set to 30 and the risk object is 'user'.
   • CDeploy the modifier to production and monitor the risk scores for a week to see if they increase as expected.
   • DRun the modifier's correlation search over a sample of historical data and verify that the risk score is added only for events that match the threat-intel condition.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A security team has a detection that assigns a risk score of 25 to the 'user' risk object for 'impossible travel' events. They also have a risk-based modifier that adds 15 to the risk score when the user is a 'vip' and subtracts 10 when the user is a 'contractor'. A 'vip' user triggers the detection. What is the final risk score for this user from this detection?

   • A30, because the modifier's +15 and -10 cancel out to +5, added to the base of 25.
   • B25, because the modifier only applies to the risk object's total score, not the individual detection's score.
   • C40, because the base score of 25 and the modifier's +15 for 'vip' are summed.
   • D15, because the modifier replaces the base score when it is applied.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A detection engineer is creating a risk-based modifier that should increase the risk score for a 'user' risk object by 20 when the user is a member of the 'Domain Admins' group, and by 5 otherwise. The engineer has already built the lookup that maps users to their group membership. What is the correct way to implement this in the risk-based modifier?

   • AConfigure the modifier to use the 'risk_object' field directly and set a static score of 20, then use a separate search to lower the score for non-privileged users.
   • BCreate two separate risk-based modifiers, one for Domain Admins with a score of 20 and one for all other users with a score of 5, and apply both to the detection.
   • CUse a lookup to enrich the event with the group, then write an 'if' statement in the modifier's correlation search that assigns a risk score of 20 or 5 based on the group value.
   • DSet the risk score to 20 in the modifier and rely on the detection's base risk score to be 5 for non-privileged users.
   Reveal Solution Discussion Select an answer first