What is the primary purpose of threat intelligence?

To replace the need for security monitoring

To automatically patch all vulnerabilities

To guarantee that no security incident will occur

To provide actionable information about current and emerging threats

What is the primary function of a Security Information and Event Management (SIEM) system?

To block malicious network traffic in real time

To automatically patch vulnerabilities

To replace the need for firewalls

To aggregate and correlate security events from multiple sources

A security team wants to detect anomalous behavior on its network. They have access to firewall logs, DNS logs, and authentication logs. Which approach would best support the detection of a potential data exfiltration attempt?

Only review firewall logs for blocked inbound connections.

Store logs in a central repository but never review them.

Correlate outbound traffic patterns with DNS queries and user authentication events.

Disable logging on DNS servers to improve performance.

A SOC wants to reduce the time to respond to common phishing alerts. Currently, analysts manually check the URL reputation, block the sender, and create a ticket. Which SOAR capability would most directly address this?

A ticketing system that tracks analyst performance.

Playbooks that automate the enrichment, blocking, and ticketing steps.

Integration with the SIEM to collect more phishing logs.

A dashboard that displays all phishing alerts in one view.

A company's SIEM generates thousands of alerts daily, but the SOC team is overwhelmed and misses critical incidents. The team wants to improve detection without adding more staff. Which approach is most effective?

Increase the log retention period to ensure more data is available for analysis.

Disable all alerts that are not confirmed as true positives.

Implement correlation rules that reduce false positives and prioritize alerts based on risk.

Route all alerts directly to the incident response team for immediate action.

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 12)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 56–60

56foundation · easy
What is the primary purpose of threat intelligence?
Select an answer first
57foundation · easy
What is the primary function of a Security Information and Event Management (SIEM) system?
Select an answer first
58application · medium
A security team wants to detect anomalous behavior on its network. They have access to firewall logs, DNS logs, and authentication logs. Which approach would best support the detection of a potential data exfiltration attempt?
Select an answer first
59application · medium
A SOC wants to reduce the time to respond to common phishing alerts. Currently, analysts manually check the URL reputation, block the sender, and create a ticket. Which SOAR capability would most directly address this?
Select an answer first
60application · medium
A company's SIEM generates thousands of alerts daily, but the SOC team is overwhelmed and misses critical incidents. The team wants to improve detection without adding more staff. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.