A security analyst receives a threat intelligence feed containing a list of malicious IP addresses and domains associated with a new malware campaign. The analyst wants to detect if any internal hosts have communicated with these indicators. Which action is most effective?

Manually check each IP address against the firewall logs.

Upload the IoCs to the SIEM and create correlation rules to match against network and endpoint logs.

Block all the IP addresses at the firewall without checking internal hosts.

Send the IoCs to the EDR vendor and wait for alerts.

When should an alert be escalated to a higher-tier analyst?

When the alert is a known false positive

When the alert is low severity and low impact

When the alert indicates a high-severity incident that requires advanced analysis

When the alert has been automatically resolved

GIAC Information Security Professional

Domain 2Objective 2

Security Operations GISP Practice Questions (Page 13)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

12concepts

Questions 61–62

61application · medium
A security analyst receives a threat intelligence feed containing a list of malicious IP addresses and domains associated with a new malware campaign. The analyst wants to detect if any internal hosts have communicated with these indicators. Which action is most effective?
Select an answer first
62foundation · easy
When should an alert be escalated to a higher-tier analyst?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Operations GISP Practice Questions (Page 13)

Questions 61–62

A security analyst receives a threat intelligence feed containing a list of malicious IP addresses and domains associated with a new malware campaign. The analyst wants to detect if any internal hosts have communicated with these indicators. Which action is most effective?

When should an alert be escalated to a higher-tier analyst?

Keep studying — Security Architecture and Operations