Rapid Response Triage at Scale GEIR Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC manager wants to measure the effectiveness of the triage process and identify areas for improvement. The team has been using a new automated correlation rule for the past month. Which metric would best indicate whether the rule is reducing alert fatigue without missing true positives?

   • AThe average time to triage an alert.
   • BThe false positive rate and the true positive rate for the rule.
   • CThe total number of alerts generated per day.
   • DThe number of alerts escalated to the incident response team.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC is receiving a large number of alerts from a new detection rule. The rule was designed to detect lateral movement, but it is triggering on legitimate administrative activity. The SOC wants to reduce false positives while keeping the rule effective. What is the best approach?

   • ARefine the rule to exclude known administrative accounts and tools, and test the rule against historical data.
   • BDisable the rule and rely on other detection methods.
   • CCreate a separate rule that generates alerts for all administrative activity.
   • DIncrease the severity of the rule so analysts pay more attention.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC has implemented an automated triage system that assigns a priority score to each alert. The system has been in place for six months, and the team has noticed that the number of true positives has decreased. The team lead suspects the system is becoming too conservative. What should the team do to address this issue?

   • ARetrain the system with recent data that includes new threat patterns.
   • BDisable the automated scoring and use manual triage only.
   • CIncrease the priority threshold so that only high-priority alerts are investigated.
   • DManually review all alerts until the system is updated.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which approach is effective for managing high-volume alert streams?

   • AAggregating similar alerts into a single incident
   • BRequiring manual review of every alert before any action
   • CIncreasing the severity of all alerts to ensure attention
   • DIgnoring alerts from low-priority systems
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In a typical triage workflow, what is the correct sequence of steps after an alert is generated?

   • AClose, prioritize, investigate, escalate
   • BEscalate, investigate, prioritize, close
   • CInvestigate, close, prioritize, escalate
   • DPrioritize, investigate, escalate, close
   Reveal Solution Discussion Select an answer first