Purple › Module 3 › Lesson 5
Quiz — DE Basics
10 APPLY items on detection-as-code, telemetry needs, and false positive cost on $PURPLE_LAB.
Opening
Detection Engineering Basics — Module Quiz
Ten APPLY items. Name DE concepts on YOUR $PURPLE_LAB — never unauthorized log collection, stranger-network sims, or untested production deploys. Original Cyberlium. Next: Sigma Named.
Knowledge Check
APPLY: Detection as code primarily means:
Multiple choice
Knowledge Check
APPLY: True or False: Telemetry needs define required sources and fields before rules can fire.
True or False
Knowledge Check
APPLY: False positive cost includes:
Multiple choice
Knowledge Check
APPLY: Tutorial collects logs from stranger systems without scope — you:
Multiple choice
Knowledge Check
APPLY: DaC repo should include:
Multiple choice
Knowledge Check
APPLY: Cyberlium NEVER allows:
Multiple choice
Knowledge Check
APPLY: T1059 detection typically requires:
Multiple choice
Knowledge Check
APPLY: True or False: Broad untested rules can cause alert storms.
True or False
Knowledge Check
APPLY: chmod 600 on DE notes means:
Multiple choice
Knowledge Check
APPLY: Next lesson after this quiz:
Multiple choice
Answer all 10 knowledge checks to continue. (0/10 answered)