// PATH EXAM

🎯 Detection Engineering

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What is YARA for? To scan ports To query Windows event logs To describe patterns (strings, bytes, conditions) that identify files or memory, typically malware To encrypt files

2. What is Sigma? A generic (YAML) format for detection rules over logs that is translated into each SIEM’s query An open-source antivirus A language to describe malware in files A protocol to ship logs

3. What is MITRE ATT&CK? An encryption standard A knowledge base of attacker tactics and techniques observed in real incidents A list of vulnerabilities A commercial SIEM

4. In the Windows Security log, which Event ID is a successful logon? 4625 4688 1102 4624

5. And a false negative? An alert closed without review A real attack the rule does not detect An alert that fires on legitimate activity A deliberately disabled rule

6. "powershell -enc SQBFAFgA…": how is the argument encoded? ASCII hexadecimal Base64 of UTF-16LE text AES-encrypted ROT13

7. Which Event ID records a process creation (with auditing enabled)? 4624 4688 4720 4104

8. What does Event ID 1102 in the Security log indicate? That a user was created That a service was installed That someone cleared the audit log A remote logon