Incident Detection And Triage →mediumMultiple ChoiceObjective-mapped

312-39 Incident Detection And Triage Practice Question

You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.

Using a Building Block (BB) allows for reusable logic. Combining a threshold condition with a 'unique count' filter on source IP addresses ensures the rule only fires when the specific cross-IP threshold is met.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use a simple threshold rule set to trigger only on the 5th failure without defining distinct source IP criteria.
Why it's wrong here
This would trigger on a single IP failing 5 times, failing the specific multi-IP requirement.
✓
Configure an Offense rule using the 'when the event matches any of these building blocks' condition and apply a 'count of unique Source IP is greater than or equal to 3' filter within the temporal window.
Why this is correct
This specifically targets the unique IP count requirement within the QRadar rule engine.
✗
Create a rule using the 'when the event matches any of these building blocks' condition combined with an 'and when at least 5 events are seen with the same username in 1 minute' filter.
Why it's wrong here
This does not account for the requirement of three distinct source IP addresses.
✗
Enable the 'Flow-based Anomaly' detection setting in the system configuration to automatically detect brute-force patterns.
Why it's wrong here
Flow-based detection is for network traffic patterns, not authentication log events.

About these practice questions

This 312-39 question is part of Courseiva's 202-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Scored practice sessions

Scored 10-question sessions with instant feedback and explanations.

Free 312-39 Practice Test 1 — 30 Questions→312-39 Practice Test 2 — 25 Questions→312-39 Practice Test 1 — 25 Questions→

Practice by domain

Domains are weighted differently on the real exam — spend your time where you score lowest.

Incident Detection And Triage Cyber Threats Iocs And Attack Methodology Proactive Threat Detection SOC For Cloud Environments

Filter by question format

Practise one question format at a time: exhibits, multi-select, drag-and-drop, troubleshooting.

Browse scenarios

Go deeper on a topic

Narrow in on a single topic rather than practising the whole bank at once.

Incident Detection And Triage practice questions Forensic Investigation And Malware Analysis practice questions SOC For Cloud Environments practice questions

Keep going

All 312-39 questions Study guide Exam domains

This 312-39 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 312-39 exam.