Question 1
Which Sigma rule field specifies the log source technology, product, and service to ensure the rule targets the correct event stream?
Correct Answer:
logsource
Question 2
A YARA rule must match a file that contains the string 'MZ' at offset 0 AND has a PE section named '.text'. Which YARA condition correctly expresses this?
Correct Answer:
uint16(0) == 0x5A4D and for any s in pe.sections: (s.name == ".text")
Question 3
In Zeek, which log file records metadata about every TCP, UDP, and ICMP connection observed on the network, including duration, bytes transferred, and connection state?
Correct Answer:
conn.log
Question 4
Which Splunk SPL command transforms raw events into a statistical table, making it essential for building detection dashboards and alert conditions?
Correct Answer:
stats
Question 5
A detection engineer wants to create a Git branch for a new Sigma rule, make changes, and merge via pull request so automated YARA/Sigma linting runs in CI. What is the correct sequence of Git commands to start this workflow?
Correct Answer:
git branch feature/sigma-rule → git checkout feature/sigma-rule → git add → git commit
Question 1
Exam overview

About this Exam

Prepare with the SBT CJDE Practice Questions - Security Blue Team Certified Junior Detection Engineer Exam practice quiz. This question bank includes 100 questions covering detection, rule, sigma, engineer, and yara. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

SBT CJDE Practice Questions - Security Blue Team Certified Junior Detection Engineer Exam

This practice set contains 100 questions from the matching question bank and focuses on detection, rule, sigma, engineer, and yara. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions