A SOC is experiencing a high volume of alerts from a new intrusion detection system (IDS). The alerts are mostly false positives, but the team is unsure which ones are real. The team lead wants to reduce the noise without losing true positives. The IDS generates alerts based on signature matching, and the team has access to endpoint logs and threat intelligence. What is the most effective approach?

Manually review all alerts to determine which are true positives.

Increase the IDS sensitivity to catch more threats, even if it generates more alerts.

Disable the IDS until the false positive rate is reduced.

Use endpoint logs to validate the IDS alerts and only escalate those that are confirmed by endpoint activity.

What is a common strategy to reduce alert fatigue?

Disabling all security monitoring tools

Tuning detection rules to reduce false positives

Assigning all alerts to a single analyst

Increasing the number of alerts sent to analysts

What is the primary purpose of rapid response triage in incident response?

To document every alert in a detailed forensic report for compliance purposes

To identify the root cause of an incident before any containment actions are taken

To quickly determine which alerts require immediate investigation and response versus those that can be deferred or closed

To automatically remediate all confirmed incidents without human intervention

A SOC is experiencing alert fatigue because a high-volume of alerts are generated by a known benign application that runs nightly. The SOC wants to reduce the number of alerts while still detecting any abnormal behavior from that application. What is the most effective approach?

Increase the alert threshold to a very high value so only extreme events alert.

Route alerts from that application to a low-priority queue without review.

Suppress all alerts from that application for the entire day.

Create a baseline of the application's normal behavior and generate alerts only when deviations from the baseline occur.

A SOC analyst is triaging a large number of alerts from a new endpoint detection and response (EDR) tool. The analyst notices that many alerts are for the same malware family but on different hosts. The analyst wants to speed up the triage process. Which automated technique would be most effective?

Increase the EDR tool's severity threshold so that only critical alerts are generated.

Create a script that automatically quarantines all hosts with the same malware family.

Manually review each alert and close the ones that are duplicates.

Use a correlation rule to group alerts by malware family and create a single incident for all affected hosts.

GIAC Enterprise Incident Responder

Domain 1Objective 3

Rapid Response Triage at Scale GEIR Practice Questions (Page 3)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 11–15

11expert · hard
A SOC is experiencing a high volume of alerts from a new intrusion detection system (IDS). The alerts are mostly false positives, but the team is unsure which ones are real. The team lead wants to reduce the noise without losing true positives. The IDS generates alerts based on signature matching, and the team has access to endpoint logs and threat intelligence. What is the most effective approach?
Select an answer first
12foundation · easy
What is a common strategy to reduce alert fatigue?
Select an answer first
13foundation · easy
What is the primary purpose of rapid response triage in incident response?
Select an answer first
14application · medium
A SOC is experiencing alert fatigue because a high-volume of alerts are generated by a known benign application that runs nightly. The SOC wants to reduce the number of alerts while still detecting any abnormal behavior from that application. What is the most effective approach?
Select an answer first
15application · medium
A SOC analyst is triaging a large number of alerts from a new endpoint detection and response (EDR) tool. The analyst notices that many alerts are for the same malware family but on different hosts. The analyst wants to speed up the triage process. Which automated technique would be most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.