Detection Engineer

Sample question 1

At Solvent Bank, detection engineer Marcus reviews four deviations that the network anomaly detection pipeline flagged this week for the transaction-processing segment: a database server that began beaconing to a single unrecognized external IP address every 58 seconds three nights ago; a marketing workstation that generated a brief spike in outbound HTTP traffic during a product launch livestream; a backup server pushing its usual large monthly transfer to the offsite replication target on the scheduled date; and a developer laptop resolving DNS lookups for a SaaS tool that IT approved last week. Marcus has time to escalate only one item today. Which one should he treat as anomalous network activity warranting immediate investigation?

1. A.The marketing workstation's HTTP spike during the livestream, since any sudden jump in outbound traffic volume from a single host is the strongest signal of compromise the pipeline can surface.
2. B.The backup server's monthly transfer to the replication target, since large recurring transfers to an external-facing destination carry more risk than a low-volume connection and deserve priority review.
3. C.The developer laptop's lookups for the newly approved SaaS tool, since a domain the environment has not seen before is the clearest indicator that the pipeline has identified something worth escalating.
4. D.The database server's regularly-timed beaconing to an unattributed external address, since nothing about its established role or history explains a new, persistent connection to an unapproved destination that appeared this week.

Sample question 2

A detection engineer at a logistics company is triaging four alerts that fired within the same 20-minute window. Alert 1: an email gateway alert that a user received a phishing message with a malicious macro attachment, which the user deleted without opening. Alert 2: an EDR alert, opened two days ago and still unresolved, for a suspicious PowerShell process spawned by Word on a different and unrelated user's machine. Alert 3: a network alert for an endpoint that has been beaconing to a previously unseen external domain every 60 seconds since that morning. Alert 4: an EDR alert, timestamped four minutes ago, that a roughly 2 GB compressed archive was just created in a temp folder on that same beaconing endpoint, coinciding with a spike in outbound traffic to that external domain. Given limited immediate response capacity, which alert should the engineer act on first?

1. A.Alert 1, because phishing delivery is the earliest point in the attack chain, and industry guidance generally treats interrupting an intrusion at the earliest available stage as the highest-value response before committing resources elsewhere.
2. B.Alert 4, because the archive creation and outbound spike on the beaconing host indicate the attacker has reached the actions-on-objectives stage and data may be leaving the network right now.
3. C.Alert 2, because a suspicious PowerShell process spawned from Word indicates initial exploitation, which analysts should generally treat as a higher priority than a network-layer beaconing alert alone.
4. D.Alert 3, because a new beaconing pattern represents the command-and-control stage, and stopping a live command-and-control channel is typically the response an analyst should prioritize ahead of other concurrent alerts.

Sample question 3

A detection engineer at a regional bank is investigating a suspected account takeover. Identity provider logs confirm the user completed multi-factor authentication successfully from a company laptop in Ohio at 9:02 AM. Two minutes later, the resource server accepts an API request carrying that session's OAuth access token, but the request originates from an IP address in Vietnam with a device fingerprint that does not match the laptop, and the IdP logs show no new sign-in at that time. Which detection rule is best suited to catching this specific technique?

1. A.Flag any account with more than five failed MFA attempts inside one minute, because that pattern usually signals brute-force credential guessing rather than a stolen live session.
2. B.Flag any account that submits two password-reset requests inside a rolling 24-hour window, because repeated resets often follow a successful credential-stuffing campaign.
3. C.Flag access-token use from a device or network context inconsistent with the session that issued it, because that mismatch signals a stolen token being replayed without re-authenticating.
4. D.Flag sign-ins that occur from two geographically distant locations within a time window shorter than travel would allow, because that impossible-travel pattern indicates a shared or stolen credential.