Rapid Response Triage at Scale GEIR Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC has a triage workflow that includes a first-level review, a second-level review, and escalation to incident response. The first-level analyst is supposed to enrich alerts with asset information and threat intelligence. However, the analyst often skips enrichment because it requires opening multiple tools. What is the best improvement to ensure enrichment is consistently performed?

   • AAssign enrichment to the second-level analyst instead.
   • BRemove the enrichment step from the workflow to save time.
   • CRequire the analyst to manually copy data from each tool into a spreadsheet.
   • DIntegrate the enrichment tools into the triage console so the analyst can see asset and threat data in one view.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large organization has a mature SOC with a well-defined triage process. During a major incident, the SOC manager wants to ensure that the triage team focuses on the most critical alerts while maintaining situational awareness. The team is receiving a high volume of alerts, many of which are low severity. What is the best approach to balance speed and accuracy?

   • AAutomatically close all low-priority alerts without review to reduce workload.
   • BAssign one analyst to review every alert in order of arrival.
   • CHave all analysts focus exclusively on high-priority alerts and ignore all others.
   • DUse a tiered triage approach where automated tools filter and prioritize alerts, and human analysts focus on high-priority alerts while periodically sampling lower-priority alerts.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A SOC has an automated triage system that uses a machine learning model to classify alerts as true or false positives. The model has a high precision but a low recall. The SOC manager is concerned about missing true positives. What is the best way to improve the system's recall without significantly reducing precision?

   • AIncrease the classification threshold to be more conservative.
   • BAdjust the classification threshold to be more sensitive, and add a human review queue for alerts that fall into the uncertain range.
   • CRetrain the model with more false positive examples.
   • DDisable the automated system and have analysts review all alerts manually.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC has implemented an automated triage system that uses machine learning to classify alerts as 'malicious' or 'benign' with 95% accuracy. The system is configured to automatically close any alert classified as 'benign' without human review. After a week, the team notices that a few genuine intrusions were missed because the system classified them as 'benign'. What is the most significant risk of this configuration, and what should the team do?

   • AAutomated closure of 'benign' alerts removes human judgment from the triage process, so the team should require human review for alerts with medium confidence scores.
   • BThe system may be biased toward false negatives, so the team should lower the classification threshold to be more conservative.
   • CThe system is not integrated with threat intelligence, so the team should add more data sources to improve accuracy.
   • DThe system may be overfitting to historical data, so the team should retrain the model with more recent data.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC analyst is triaging a large number of alerts after a phishing campaign. The analyst must decide which alerts to investigate first. The organization has a mix of servers, workstations, and executive laptops. Which approach best aligns with the goals of rapid response triage?

   • AWait for the threat intelligence team to provide a full analysis before starting triage.
   • BPrioritize alerts involving executive laptops and critical servers, then move to workstations.
   • CInvestigate alerts in the order they were received, starting with the oldest.
   • DInvestigate all alerts equally to ensure no threat is missed.
   Reveal Solution Discussion Select an answer first