Security Operations GISP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does a SIEM system help in incident detection?

   • ABy encrypting all network traffic
   • BBy physically isolating infected systems
   • CBy correlating events from different sources to identify suspicious patterns
   • DBy scanning for open ports
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company deploys an intrusion prevention system (IPS) in inline mode at the network perimeter. The security team notices that the IPS is blocking legitimate traffic due to false positives. What should the team do to reduce the impact while maintaining security?

   • ASwitch the IPS to detection-only mode and review alerts before blocking.
   • BImmediately block all traffic that triggers an alert.
   • CDisable the IPS entirely and rely on the firewall for protection.
   • DIncrease the sensitivity of the IPS rules to catch more threats.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After containing a malware outbreak, the incident response team is in the eradication phase. Which activity is most aligned with this phase?

   • ARemoving the malware from all affected systems and ensuring no remnants remain.
   • BRestoring systems from backups and verifying they are operational.
   • CIsolating affected systems to prevent further spread.
   • DConducting a lessons-learned meeting to improve future response.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During which phase of the incident response lifecycle are systems restored to normal operation and validated to ensure they are no longer compromised?

   • ARecovery
   • BContainment
   • CEradication
   • DLessons learned
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An EDR tool flags a process on a user's laptop as malicious, but the user insists the application is required for their job. The analyst sees that the process is digitally signed by a reputable vendor and has been running for months. The alert is based on a behavioral rule that flags unusual network activity. What should the analyst do?

   • AImmediately quarantine the laptop because the EDR flagged the process.
   • BInvestigate the network activity associated with the process before deciding to block or allow it.
   • CDisable the EDR rule that triggered the alert.
   • DAllow the process because it is signed by a reputable vendor.
   Reveal Solution Discussion Select an answer first