KC-5 — Chapter 5 Knowledge Check
Questions and answer context for Chapter 5
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. What is the purpose of the <if_sid> element in a Wazuh rule?
A. It sets the alert severity
B. It defines the decoder used
C. It causes the rule to evaluate only after a specified parent rule has already matched
D. It disables the rule
2. Where should custom Wazuh rules be stored so they survive ruleset updates?
A. In a separate local rule file
B. Directly inside the vendor rule files
C. In suricata.yaml
D. In the Wazuh Indexer configuration
3. What is the correct first step before assuming a custom rule “doesn’t work”?
A. Reinstall the Wazuh Manager
B. Delete the rule and start over
C. Restart the Wazuh Indexer
D. Test it with wazuh-logtest against a sample log line
4. In wazuh-logtest output, which phase shows whether your rule actually matched?
A. Phase 1 — Pre-decoding
B. Phase 2 — Decoding
C. Phase 3 — Rule filtering
D. There is no phase for this
5. Why does professional rule validation include testing activity that should NOT trigger the rule?
A. It helps confirm the rule is specific enough to avoid false positives
B. It is not necessary — only positive matches matter
C. Wazuh requires at least two test cases per rule
D. It has no real value
6. What is the primary goal of detection tuning?
A. To generate as many alerts as possible
B. To disable all default rules
C. To increase Suricata’s packet capture rate
D. To reduce false positives while preserving useful, actionable alerts
7. Why are multi-source correlation rules generally higher-confidence than single-source rules?
A. They are required by Wazuh licensing
B. No single sensor observes an entire attack; combining sources reduces the chance of a false conclusion
C. They run faster than single-source rules
D. They use less disk space
8. Which of the following is a legitimate objective metric for measuring detection effectiveness?
A. The percentage of rules that have descriptive names
B. The number of analysts on shift
C. The ratio of true positives to total alerts generated by a rule
D. The number of detection rules stored in the repository
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | C | <if_sid> makes the rule evaluate only after its specified parent rule matches. |
| 2 | A | Local rule files survive vendor ruleset updates. |
| 3 | D | wazuh-logtest against a sample log line is the first rule-matching test. |
| 4 | C | Phase 3 (rule filtering) shows which rule matched. |
| 5 | A | Negative testing confirms the rule is specific enough to avoid false positives. |
| 6 | D | Tuning reduces false positives while preserving actionable alerts. |
| 7 | B | Multiple independent sources reduce the chance of a false conclusion. |
| 8 | C | True-positive ratio is an objective effectiveness metric. |