What is the purpose of validating a security analytic using historical data?

To determine the cost of running the analytic

To reduce the number of data sources needed

To test the analytic against known events to ensure it detects them correctly

To increase the speed of the analytic

Which of the following is a key component of a well-written security use case?

A clear description of the threat or behavior to detect

The number of analysts required to respond to alerts

The exact query syntax to be used

A SOC's analytic for 'lateral movement via SMB' only alerts when a single source IP connects to more than 10 distinct destination IPs on port 445 within 5 minutes. An attacker is moving slowly, connecting to one or two machines at a time, and is not being detected. What tuning change would best reduce this false negative?

Lower the threshold to 5 distinct destination IPs and extend the time window to 30 minutes.

Add a filter to exclude connections to the domain controller.

Remove the time window and alert on any single SMB connection.

Increase the threshold to 20 distinct destination IPs to focus on larger attacks.

What is the purpose of continuous improvement in the context of security analytics?

To eliminate the need for tuning

To reduce the number of analytics in use

To ensure analytics remain effective as threats and operational needs evolve

A SOC's analytic for 'malicious PowerShell' only detects encoded commands. A recent incident involved a PowerShell script that was not encoded, and the analytic missed it. The team wants to improve detection of non-encoded malicious PowerShell without generating excessive false positives. Which approach is best?

Add a rule that alerts on any PowerShell script that contains suspicious keywords like 'DownloadString' or 'Invoke-Expression'.

Expand the analytic to include both encoded and non-encoded PowerShell, using a combination of keywords and behavioral indicators like script block logging.

Create a baseline of normal PowerShell usage and alert on deviations from that baseline.

Increase the frequency of the analytic to run every minute.

GIAC Security Operations Certified

Domain 3Objective 2

Analytic Design and Tuning GSOC Practice Questions (Page 1)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 1–5

1foundation · easy
What is the purpose of validating a security analytic using historical data?
Select an answer first
2foundation · easy
Which of the following is a key component of a well-written security use case?
Select an answer first
3application · medium
A SOC's analytic for 'lateral movement via SMB' only alerts when a single source IP connects to more than 10 distinct destination IPs on port 445 within 5 minutes. An attacker is moving slowly, connecting to one or two machines at a time, and is not being detected. What tuning change would best reduce this false negative?
Select an answer first
4foundation · easy
What is the purpose of continuous improvement in the context of security analytics?
Select an answer first
5expert · hard
A SOC's analytic for 'malicious PowerShell' only detects encoded commands. A recent incident involved a PowerShell script that was not encoded, and the analytic missed it. The team wants to improve detection of non-encoded malicious PowerShell without generating excessive false positives. Which approach is best?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.