Multiple Choice
When writing custom correlation rules, the analyst should focus on
A) multiple security controls and events specific to the environment.
B) any one specific high-quality indicator of compromise.
C) malware alerts announced by industry security groups.
D) firewall events, as they provide the first indication of a compromise.
Correct Answer:
Verified
Correct Answer:
Verified
Q3: How often does the configuration and policy
Q6: The analyst has created a correlation rule
Q42: Which of the following are the three
Q52: Which of the following operations is NOT
Q55: If there is no firewall at the
Q56: A security administrator is configuring the Enterprise
Q58: Which of the following statements about Client
Q60: Which of the following two appliances contain
Q62: Where can the ESM event database archive
Q84: Malware performing a network enumeration scan will