// PATH EXAM

🎯 Detection Engineering

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What does PowerShell Event ID 4104 (Script Block Logging) record? The content of the script blocks that run, already decoded Logons Password changes Network connections

2. Which Event ID records a process creation (with auditing enabled)? 4624 4104 4688 4720

3. In KQL (Sentinel, Defender), which operator filters the rows that meet a condition? project where extend summarize

4. What is Sigma? An open-source antivirus A language to describe malware in files A protocol to ship logs A generic (YAML) format for detection rules over logs that is translated into each SIEM’s query

5. And a failed logon? 4624 4720 7045 4625

6. What does Event ID 1102 in the Security log indicate? A remote logon That someone cleared the audit log That a user was created That a service was installed

7. "powershell -enc SQBFAFgA…": how is the argument encoded? AES-encrypted Base64 of UTF-16LE text ASCII hexadecimal ROT13

8. What is a false positive in a detection rule? An attack that raises no alert An alert that fires on legitimate activity A duplicated log A rule that does not compile