Rapid Response Triage at Scale GEIR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An alert indicates a potential malware infection on a server that hosts a customer-facing application. The server is not in the critical asset list, but the application is revenue-generating. How should the triage analyst prioritize this alert?

   • AEscalate to the highest severity level immediately without further analysis.
   • BTreat it as high priority because the business context indicates the application is revenue-generating.
   • CTreat it as low priority because the server is not in the critical asset list.
   • DIgnore the alert until the asset list is updated.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center (SOC) receives 2,000 alerts per hour. The triage team is overwhelmed and high-severity incidents are being missed. The SOC manager wants to prioritize alerts based on the potential business impact. Which approach best achieves this while reducing the workload?

   • AImplement a scoring model that combines asset criticality, threat severity, and business context to rank alerts before human review.
   • BRoute alerts to the first available analyst in a round-robin fashion.
   • CIncrease the number of triage analysts to manually review every alert in the queue.
   • DAutomatically close all low-severity alerts without any review.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization has implemented an automated triage system that automatically quarantines endpoints when a high-confidence malware alert is triggered. During a recent incident, the system quarantined a critical production server that was running a legitimate but rare application. What is the best way to prevent this from happening again?

   • AAdd an exception for the specific application in the automated response rule and require human approval before quarantine for critical assets.
   • BRemove the critical server from the automated response scope entirely.
   • CIncrease the confidence threshold for all malware alerts to reduce false positives.
   • DDisable all automated quarantine actions and require manual review for every alert.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's SIEM generates thousands of alerts from a new EDR product. Many are false positives caused by a legitimate administrative tool. The SOC wants to reduce noise without completely disabling the rule. What should the SOC do first?

   • ADisable the EDR alerting rule entirely until the tool is no longer used.
   • BIncrease the alert severity to force analysts to review every alert.
   • CCreate a suppression rule that excludes the specific administrative tool's process hash and command-line patterns from the alerting rule.
   • DForward all alerts to a separate mailbox for the IT team to review.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is an asset inventory valuable during triage?

   • AIt helps identify which users are logged into a system
   • BIt provides a list of known malware signatures
   • CIt provides real-time network traffic data
   • DIt helps determine if an affected system is critical and who owns it
   Reveal Solution Discussion Select an answer first