KC-4 — Chapter 4 Knowledge Check
Questions and answer context for Chapter 4
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. What is the primary purpose of the Discover interface in Wazuh?
A. To configure agent installation
B. To write Suricata rules
C. To search, filter, and investigate security events
D. To manage VMware snapshots
2. Why do experienced analysts expand the time window before and after an alert?
A. To reduce the number of events displayed
B. To reveal related activity that provides context for the investigation
C. To improve Suricata performance
D. It is required by the Wazuh license
3. Which best describes an Indicator of Compromise (IOC)?
A. A tactic used by MITRE ATT&CK
B. A category of Wazuh detection rule severity
C. A type of VMware network adapter
D. A forensic artifact such as a file hash, IP address, or domain tied to a known threat
4. Which best describes an Indicator of Attack (IOA)?
A. Evidence of attacker behavior or technique in progress, regardless of the specific tool used
B. A signature-based antivirus detection
C. A firewall configuration setting
D. A Suricata rule category
5. In MITRE ATT&CK, what does a technique ID such as T1059.001 represent?
A. A tactic
B. A Suricata signature ID
C. A Wazuh rule ID
D. A sub-technique — in this case, PowerShell under Command and Scripting Interpreter
6. Which MITRE ATT&CK tactic best describes T1003 (OS Credential Dumping)?
A. Discovery
B. Exfiltration
C. Credential Access
D. Initial Access
7. What is the purpose of the MITRE ATT&CK Navigator in a SOC?
A. To visualize and measure which adversary techniques the SOC can currently detect
B. To replace the Wazuh Dashboard
C. To install Suricata rules automatically
D. To generate VMware snapshots
8. Why should analysts avoid forming a conclusion before collecting evidence?
A. Evidence collection is optional in professional investigations
B. Premature conclusions introduce confirmation bias and can lead to incorrect findings
C. Wazuh requires evidence to be collected in a specific order
D. It has no real effect on investigation quality
9. What is the main goal of professional incident documentation?
A. To satisfy a checklist requirement
B. To reduce the number of alerts generated
C. To automatically close tickets
D. To allow another analyst to understand and reproduce your reasoning without speaking to you
10. Why is correlating endpoint and network telemetry more valuable than examining either source alone?
A. It reduces the total number of alerts
B. It is required by Wazuh licensing
C. No single sensor sees the entire attack; combining sources produces a more complete and reliable picture
D. Network telemetry is always more accurate than endpoint telemetry
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | C | Discover is the search, filter, and investigation interface. |
| 2 | B | A wider window reveals surrounding activity and context. |
| 3 | D | IOCs are forensic artifacts tied to known threats (hashes, IPs, domains). |
| 4 | A | IOAs describe attacker behavior in progress, independent of tooling. |
| 5 | D | T1059.001 is the PowerShell sub-technique of Command and Scripting Interpreter. |
| 6 | C | T1003 belongs to the Credential Access tactic. |
| 7 | A | Navigator visualizes and measures detection coverage. |
| 8 | B | Premature conclusions introduce confirmation bias. |
| 9 | D | Documentation should let another analyst reproduce your reasoning. |
| 10 | C | No single sensor sees the whole attack; correlation completes the picture. |