Rapid Response Triage at Scale GEIR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) receives 15,000 alerts per day, but analysts only investigate about 200. The team lead wants to reduce the noise so analysts can focus on genuine threats. The SIEM already ingests endpoint, network, and identity logs. Which approach should the team implement first to reduce alert volume while preserving detection coverage?

   • AIncrease the severity threshold so that only critical and high-severity alerts are generated, and suppress all medium and low alerts.
   • BIncrease the number of analysts on shift so that more alerts can be manually reviewed each day.
   • CDeploy a machine learning model that scores every alert based on historical analyst decisions, and automatically close any alert with a score below 0.5.
   • DCreate correlation rules that group related low-severity alerts into a single incident and auto-close those with no confirmed malicious activity after 24 hours.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC is experiencing alert fatigue due to a high volume of low-priority alerts. The SOC manager wants to reduce the number of alerts that analysts need to review without increasing the risk of missing true positives. What is the best strategy?

   • ARoute low-priority alerts to a separate email folder without any review.
   • BImplement a risk-based alert prioritization system that assigns scores based on asset criticality and threat severity, and automatically suppress alerts below a certain score.
   • CDisable all low-priority alert rules.
   • DIncrease the number of analysts to review all alerts.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a small SOC and receives a burst of alerts during a widespread phishing campaign. The SOC manager wants to ensure that the most critical business functions are protected first. What is the primary goal of rapid response triage in this situation?

   • ATo quickly identify which alerts require immediate action based on the potential impact to critical business functions.
   • BTo investigate every alert thoroughly to determine the root cause of the phishing campaign.
   • CTo document all alerts for compliance purposes before taking any action.
   • DTo contain all affected systems immediately, regardless of the alert's validity.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How can scripting be used to accelerate triage?

   • ABy generating final incident reports without analyst review
   • BBy automating repetitive data collection and enrichment tasks, such as pulling IP reputation or user details
   • CBy automatically patching vulnerabilities on affected systems
   • DBy replacing the need for human analysts entirely
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How can feedback from triage outcomes be used to improve the triage process?

   • ABy requiring more manual steps in the triage workflow
   • BBy adjusting detection rules based on which alerts were confirmed as false positives
   • CBy increasing the severity of all alerts to ensure they are not missed
   • DBy deleting all historical alert data to reduce noise
   Reveal Solution Discussion Select an answer first