Rapid Response Triage at Scale GEIR Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC is triaging an alert about a potential data exfiltration from a file server. The file server contains sensitive customer data. The alert is based on an unusual outbound transfer. The analyst has limited information and must decide whether to escalate. What is the best course of action?

   • AClose the alert as a false positive because the transfer is unusual but not confirmed malicious.
   • BEscalate the alert immediately because the asset contains sensitive data and the potential impact is high.
   • CEscalate only if the outbound transfer exceeds a certain size threshold.
   • DWait for more information from the threat intelligence feed before escalating.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC analyst is triaging an alert about a user account that has been locked out multiple times. The analyst wants to determine if this is a brute-force attack or a user forgetting their password. Which data source would be MOST helpful to make this determination?

   • AAuthentication logs showing the source IP addresses and timestamps of the failed attempts.
   • BThe threat intelligence feed to see if the user's IP is malicious.
   • CThe asset inventory to see what type of computer the user has.
   • DThe user's HR record to see if they have a history of forgetting passwords.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC has implemented an automated triage system that uses machine learning to score alerts and automatically closes low-scoring alerts. The system has been in place for a month, and the SOC manager notices that the number of confirmed incidents has decreased, but the number of missed incidents (false negatives) has increased. What is the most likely cause and the best corrective action?

   • AThe model is working correctly, but the analysts are not reviewing the closed alerts; require analysts to review all closed alerts.
   • BThe model is overfitted to historical data and is closing true positives; retrain the model with a more balanced dataset and include human feedback on closed alerts.
   • CThe model is not aggressive enough; lower the threshold for closing alerts to reduce the number of alerts reviewed.
   • DThe model is too complex; simplify the model to reduce false positives.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which factor is most directly related to the criticality of an asset when prioritizing alerts?

   • AThe asset's role in the organization, such as a domain controller or financial database
   • BThe age of the operating system installed on the asset
   • CThe physical location of the asset in the data center
   • DThe number of alerts generated by that asset in the past week
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When prioritizing an alert, which combination of factors should be considered together?

   • AThe alert ID and the timestamp of the alert
   • BThe source IP address and the destination port only
   • CTime of day and the analyst's workload
   • DAsset value, threat severity, and business impact
   Reveal Solution Discussion Select an answer first