Log Analysis and Alerting GCDA Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   An analyst is triaging an alert that fired when a user account was created and then immediately added to the Domain Admins group. The alert has a severity of 'high'. During triage, the analyst checks the account creation logs and sees that the account was created by a known administrator account during business hours. What is the most appropriate next step?

   • AEscalate the alert to the incident response team immediately without further investigation
   • BClose the alert as a false positive because the creation was done by a known admin
   • CCheck if the account creation and group addition match an approved change request or ticketing system
   • DDisable the correlation rule to prevent future alerts
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An analyst is triaging an alert that fired when a user logged in from a new device and then immediately changed their password. The alert severity is 'medium'. The analyst checks the user's manager and finds that the user is on a known business trip. The new device is a company-issued laptop. What is the most appropriate triage decision?

   • ADisable the user's account until the activity is fully investigated
   • BClose the alert as a false positive because the user is on a business trip and using a company laptop
   • CContact the user to verify that they changed their password and logged in from the new device
   • DEscalate the alert to incident response because a password change after a new device login is always suspicious
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is investigating an alert that fired when a user downloaded a file from an external website and then executed it. The alert severity is 'medium'. The analyst checks the file hash against a threat intelligence feed and finds no known malicious indicators. What should the analyst do next?

   • AEscalate the alert to incident response immediately
   • BClose the alert as a false positive because the file hash is not known malicious
   • CReview the file's behavior in a sandbox and check the reputation of the download source
   • DDisable the correlation rule because it is producing false positives
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An analyst is triaging an alert for a PowerShell process that made an outbound connection to a known malicious IP. The alert includes the hostname, user, and command line. The analyst checks the host's process creation logs and sees that the PowerShell process was spawned by a legitimate administrative script that is scheduled to run nightly. The script is known to download updates from a vendor CDN, but the IP in the alert is not the vendor's CDN. What is the most appropriate triage action?

   • AEscalate the alert to incident response without further analysis because the IP is on a threat intel list.
   • BInvestigate the specific IP address and the script's behavior to determine if the script has been modified or if the IP is a new legitimate endpoint.
   • CIsolate the host immediately because the IP is known malicious.
   • DClose the alert as a false positive because the script is known and scheduled.
   Reveal Solution Discussion Select an answer first