Rapid Response Triage at Scale GEIR Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Why is human-in-the-loop decision making important in triage?

   • AIt allows human analysts to validate automated decisions and catch false positives or novel threats
   • BIt ensures that every alert is manually investigated from scratch
   • CIt speeds up triage by removing all human oversight
   • DIt eliminates the need for automated systems
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which principle is most important when performing triage at scale during a large-scale incident?

   • AInvestigating alerts in the order they arrive, regardless of severity
   • BAchieving 100% accuracy on every alert before any action is taken
   • CDelegating all triage decisions to automated systems without human review
   • DFocusing on the most critical alerts first while maintaining situational awareness of the overall alert volume
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC receives a high volume of alerts from a new endpoint detection and response (EDR) tool. Many alerts are for the same malware family affecting multiple hosts. The team wants to reduce the number of individual alerts and speed up triage. Which automated technique would be most effective?

   • AIncrease the EDR tool's severity threshold so that only critical alerts are generated.
   • BUse a script to automatically quarantine all affected hosts without analyst review.
   • CManually review each alert and close the ones that are duplicates.
   • DCreate a correlation rule that groups alerts by malware family and host, and creates a single incident per group.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC has a triage workflow where all alerts are initially processed by an automated system that enriches them with threat intelligence and asset context. The system then assigns a priority score. However, analysts have noticed that some high-priority alerts are actually false positives, and some low-priority alerts are true positives. The team wants to improve the workflow. Which change would most effectively address this issue?

   • AAdjust the scoring algorithm to weight threat intelligence more heavily and asset context less heavily.
   • BRemove the automated scoring and have analysts manually review every alert.
   • CImplement a feedback loop where analysts can flag incorrect scores, and use this data to retrain the scoring model.
   • DIncrease the number of analysts so that more alerts can be manually reviewed after the automated scoring.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC has implemented an automated triage system that uses a scoring algorithm to prioritize alerts. The system has been in place for three months, and the team has noticed that the number of false positives has increased. The team lead suspects the scoring algorithm is not adapting to new threats. What should the team do to address this issue?

   • AIncrease the scoring threshold so that only high-scoring alerts are investigated.
   • BRetrain the scoring algorithm with recent data that includes new threat patterns.
   • CManually review all alerts until the algorithm is updated.
   • DDisable the automated scoring and use manual triage only.
   Reveal Solution Discussion Select an answer first