A SOC manager wants to measure the effectiveness of the triage process. The team has been manually reviewing alerts and escalating some to incident response. Which metric would be MOST useful to evaluate whether the triage team is correctly identifying true positives?

The percentage of escalated alerts that are confirmed as real incidents.

The number of analysts on the triage team.

The average time to escalate an alert.

The total number of alerts received per day.

A SOC manager wants to improve the triage process. The team currently has a high number of false positives and a long time-to-escalation. The manager is considering two changes: (1) implementing a new alert enrichment tool and (2) changing the escalation criteria. Which approach would be MOST effective to reduce false positives and improve escalation accuracy?

Focus only on reducing false positives by increasing the alert threshold.

Implement the enrichment tool first, then use the enriched data to refine the escalation criteria based on observed outcomes.

Implement both changes simultaneously without measuring the impact.

Change the escalation criteria first, then implement the enrichment tool to validate the new criteria.

A SOC has a triage workflow where all alerts are initially reviewed by a junior analyst. The analyst escalates to a senior incident responder if the alert involves a critical asset or active exploitation. The SOC notices that some critical alerts are being escalated late because the junior analyst is unsure about the asset's business value. What is the best improvement to the workflow?

Remove the escalation step and let the junior analyst handle all incidents.

Escalate all alerts to the senior responder for final classification.

Integrate the asset inventory into the triage console so the analyst sees the asset's criticality and business owner automatically.

Require the junior analyst to call the asset owner for every alert before escalation.

A SOC uses a SIEM with correlation rules to detect potential intrusions. The rules generate many alerts that are actually false positives. The SOC wants to use machine learning to improve the accuracy of alert triage. What is the best way to apply machine learning in this context?

Replace all correlation rules with machine learning models without any human review.

Train a model on historical alerts that have been labeled as true or false positives to predict the likelihood of new alerts being true.

Use machine learning to generate more alerts from the same data.

Use machine learning to automatically block all IPs that appear in alerts.

GIAC Enterprise Incident Responder

Domain 1Objective 3

Rapid Response Triage at Scale GEIR Practice Questions (Page 8)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36application · medium
A SOC manager wants to measure the effectiveness of the triage process. The team has been manually reviewing alerts and escalating some to incident response. Which metric would be MOST useful to evaluate whether the triage team is correctly identifying true positives?
Select an answer first
37expert · hard
A SOC manager wants to improve the triage process. The team currently has a high number of false positives and a long time-to-escalation. The manager is considering two changes: (1) implementing a new alert enrichment tool and (2) changing the escalation criteria. Which approach would be MOST effective to reduce false positives and improve escalation accuracy?
Select an answer first
38foundation · easy
Which data source is most useful for enriching an alert about a suspicious external IP address?
Select an answer first
39application · medium
A SOC has a triage workflow where all alerts are initially reviewed by a junior analyst. The analyst escalates to a senior incident responder if the alert involves a critical asset or active exploitation. The SOC notices that some critical alerts are being escalated late because the junior analyst is unsure about the asset's business value. What is the best improvement to the workflow?
Select an answer first
40application · medium
A SOC uses a SIEM with correlation rules to detect potential intrusions. The rules generate many alerts that are actually false positives. The SOC wants to use machine learning to improve the accuracy of alert triage. What is the best way to apply machine learning in this context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.

Rapid Response Triage at Scale GEIR Practice Questions (Page 8)

Questions 36–40

A SOC manager wants to measure the effectiveness of the triage process. The team has been manually reviewing alerts and escalating some to incident response. Which metric would be MOST useful to evaluate whether the triage team is correctly identifying true positives?

Which data source is most useful for enriching an alert about a suspicious external IP address?

A SOC uses a SIEM with correlation rules to detect potential intrusions. The rules generate many alerts that are actually false positives. The SOC wants to use machine learning to improve the accuracy of alert triage. What is the best way to apply machine learning in this context?

Keep studying — Incident Response Foundations