Practice tests · 52 items

Detection Engineering & Incident Response practice test

SIEM connectors, Google SecOps, Elastic, EDR/XDR, cloud detection and response, SOAR, threat intelligence, YARA and retrohunting. Investigate evidence, verify vulnerability-assessment coverage and rehearse containment and recovery. The pool for this topic holds 14 easy, 28 medium and 10 hard items. Each answer comes with its reasoning and a link to the question or concept page it was drawn from.

Configure a test

Topic

Difficulty

Questions

14 in this pool · about 7 min

Reveal answers

Sample items with answers

easy · sample

What turns a security alert into an incident?

Any alert with a severity score above a fixed threshold, as assigned automatically by the SIEM

✓A declared decision, against written criteria, that a real threat to assets or policy exists

The number of alerts from the same host passing ten in one hour

A customer complaint about the affected service

Alerts are hypotheses. Declaring an incident is a decision by an on-call responder against defined criteria, and it starts obligations: a commander, evidence handling, containment and possibly notification clocks.

easy · sample

An EDR alert shows Word spawning PowerShell with an encoded command. What should you do with the command?

✓Decode it in a safe tool and read it, without executing it

Run it on a spare laptop to see what it does

Ignore it, because encoded commands are common in admin scripts

Paste it into a public AI chatbot to ask what it means, since that is the quickest way to get an explanation

Decoding is safe and fast; executing it risks infection, and pasting it into public services can leak data or tip off the attacker. Then follow the process tree and network activity to decide on containment.

After the test

Choosing from options is easier than reasoning it out in front of a panel. These pages make you reason it out: