What is the primary purpose of escalation in a triage workflow?

To transfer an alert to a higher level of expertise or authority when it exceeds the current responder's capability

To reduce the number of alerts in the queue

To automatically close alerts that are false positives

To document the alert in the incident management system

Which metric is most useful for measuring the efficiency of the triage process?

Total number of alerts generated per day

Number of security tools deployed

What is a risk of over-relying on automated triage systems?

They may miss context that a human analyst would recognize, leading to incorrect prioritization

They always produce false positives

They are too slow for large-scale incidents

They require more human intervention than manual triage

A SOC is overwhelmed by alerts from a new firewall rule that generates a high number of false positives. The rule was intended to detect outbound connections to known malicious IPs, but it is also flagging legitimate traffic to a partner's IP range. The team wants to reduce the false positives without losing the detection capability. What should they do?

Create a separate rule for the partner's IP range to generate alerts for that traffic.

Add the partner's IP range to an allowlist in the correlation rule.

Disable the rule entirely to stop the false positives.

Increase the severity of the rule so that only critical alerts are generated.

During triage of an alert, an analyst sees a suspicious outbound connection from a database server to an external IP. The analyst wants to determine if this is a real threat or a false positive. Which data source would be MOST useful to validate the alert?

The server's asset inventory to confirm its operating system version.

A list of recently patched servers to check if this server is up to date.

Threat intelligence feed to check if the external IP is known malicious.

The company's employee directory to see who owns the server.

GIAC Enterprise Incident Responder

Domain 1Objective 3

Rapid Response Triage at Scale GEIR Practice Questions (Page 9)

Part of the Incident Response Foundations domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
What is the primary purpose of escalation in a triage workflow?
Select an answer first
42foundation · easy
Which metric is most useful for measuring the efficiency of the triage process?
Select an answer first
43foundation · easy
What is a risk of over-relying on automated triage systems?
Select an answer first
44application · medium
A SOC is overwhelmed by alerts from a new firewall rule that generates a high number of false positives. The rule was intended to detect outbound connections to known malicious IPs, but it is also flagging legitimate traffic to a partner's IP range. The team wants to reduce the false positives without losing the detection capability. What should they do?
Select an answer first
45application · medium
During triage of an alert, an analyst sees a suspicious outbound connection from a database server to an external IP. The analyst wants to determine if this is a real threat or a false positive. Which data source would be MOST useful to validate the alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GEIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GEIR” is a trademark of its owner, used for identification only.