Rapid Response Triage at Scale GEIR Practice Questions (Page 10)

Questions 46–47

1. 46foundation · easy

   Which automated technique is commonly used to correlate multiple low-severity events into a single high-severity alert?

   • AThreat intelligence enrichment
   • BScripted log parsing
   • CMachine learning anomaly detection
   • DCorrelation rules
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A SOC manager is reviewing the triage metrics for the past quarter. The team has been using a new automated correlation rule that was supposed to reduce false positives. The data shows that the total number of alerts has decreased, but the number of true positives has also decreased. The manager suspects the rule is too aggressive. What should the manager do?

   • ADisable the rule and revert to the previous triage process.
   • BReview the rule's logic and adjust it to be less aggressive, then monitor the metrics for the next month.
   • CIncrease the severity threshold for the rule to reduce the number of alerts further.
   • DKeep the rule as is, because the decrease in true positives may be due to a decrease in actual threats.
   Reveal Solution Discussion Select an answer first