Security Operations GISP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An endpoint detection and response (EDR) tool alerts on a suspicious process executing on a laptop. The analyst sees that the process is attempting to communicate with an external IP. What is the most appropriate immediate action for the analyst to take?

   • AIsolate the endpoint from the network to prevent further communication.
   • BDelete the process from the endpoint immediately.
   • CIgnore the alert because EDR alerts are often false positives.
   • DReboot the endpoint to clear the process from memory.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team wants to improve its ability to detect a multi-stage attack that spans multiple systems and time periods. The attack involves initial phishing, lateral movement, and data exfiltration. Which SIEM capability is most important for this detection?

   • AReal-time log collection from all endpoints.
   • BAutomated alerting to the SOC team.
   • CCorrelation rules that link events across different log sources and time windows.
   • DLong-term log storage for compliance purposes.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   During an incident, the SOC identifies a compromised server that is part of a critical business application. The server is running and the attacker is actively using it. The incident response team must balance the need to preserve evidence with the need to minimize business disruption. Which action best balances these competing requirements?

   • AKeep the server running to gather more intelligence about the attacker's actions.
   • BIsolate the server from the network, capture a memory dump, and then begin eradication.
   • CImmediately shut down the server to stop the attacker and preserve evidence.
   • DDisconnect the server and reimage it immediately to restore service.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team is overwhelmed by thousands of SIEM alerts per day, many of which are low-severity and require repetitive manual actions. The team wants to reduce analyst fatigue while ensuring that high-severity alerts still receive human review. Which approach best achieves this goal?

   • AImplement a SOAR platform to automate enrichment and response for low-severity alerts, escalating only high-severity ones.
   • BIncrease the SIEM correlation rules to generate more specific alerts.
   • CHire more analysts to manually review every alert.
   • DDisable all low-severity SIEM rules to reduce alert volume.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A threat intelligence platform provides a feed of IP addresses that are known to be part of a botnet. The SOC wants to block these IPs at the firewall. However, some of the IPs are also used by a legitimate cloud service that the company relies on. What is the best way to use this intelligence without disrupting business operations?

   • ABlock all the IPs immediately to protect the network.
   • BIgnore the intelligence because it is not specific enough.
   • CBlock the IPs only during off-peak hours.
   • DCorrelate the IPs with internal logs to identify actual connections before blocking.
   Reveal Solution Discussion Select an answer first