INCIDENT DETECTION AND VERIFICATION

QUESTION 1 OF 5

Do detection tools have limitations in their detection capabilities?

YesCorrect Answer

Explanation:

Detection tools have limitations in their detection capabilities. Detection tools are an important part of incident detection and response, but they cannot detect everything. Additional methods of detection can be used to improve coverage and accuracy.

QUESTION 2 OF 5

Why do security analysts refine alert rules? Select two answers.

To reduce false positive alertsCorrect Answer

To increase alert volumes

To improve the accuracy of detection technologiesCorrect Answer

To create threat intelligence

Explanation:

Security analysts refine alert rules to improve the accuracy of detection technologies and reduce false positive alerts. Rules are adjusted to match the activity intended to be detected.

QUESTION 3 OF 5

Fill in the blank: _____ involves the investigation and validation of alerts.

AnalysisCorrect Answer

Honeypot

Detection

Threat hunting

Explanation:

Analysis involves the investigation and validation of alerts.

QUESTION 4 OF 5

What are some causes of high alert volumes? Select two answers.

Refined detection rules

Broad detection rulesCorrect Answer

Sophisticated evasion techniques

Misconfigured alert settingsCorrect Answer

Explanation:

Misconfigured alert settings and broad detection rules are some causes of high alert volumes.

QUESTION 5 OF 5

What actions do security analysts perform during the Detection and Analysis phase of the NIST Incident Response Lifecycle? Select two answers.

Create incident response plans

Validate security alertsCorrect Answer

Investigate security alertsCorrect Answer

Configure alert settings

Explanation:

Security analysts investigate and validate security alerts during the Detection and Analysis phase of the NIST Incident Response Lifecycle.

Ready to test your recall?

Do detection tools have limitations in their detection capabilities?

Yes

How confident are you in this answer?