// PATH EXAM

🎯 Detection Engineering

8 questions; you pass with 6. It is graded on the server and you will only see your score. If you pass, you can issue your certificate. Review the path first

1. What is Sigma? An open-source antivirus A generic (YAML) format for detection rules over logs that is translated into each SIEM’s query A language to describe malware in files A protocol to ship logs

2. What is a false positive in a detection rule? An attack that raises no alert A rule that does not compile A duplicated log An alert that fires on legitimate activity

3. "powershell -enc SQBFAFgA…": how is the argument encoded? Base64 of UTF-16LE text ROT13 ASCII hexadecimal AES-encrypted

4. What does PowerShell Event ID 4104 (Script Block Logging) record? Logons Password changes Network connections The content of the script blocks that run, already decoded

5. In KQL (Sentinel, Defender), which operator filters the rows that meet a condition? summarize project where extend

6. What is MITRE ATT&CK? A list of vulnerabilities An encryption standard A knowledge base of attacker tactics and techniques observed in real incidents A commercial SIEM

7. Which Event ID records a process creation (with auditing enabled)? 4720 4104 4688 4624

8. And a false negative? An alert that fires on legitimate activity An alert closed without review A real attack the rule does not detect A deliberately disabled rule