A new analytic that flags 'outbound connections to known malicious IPs' is producing a high number of false positives because several workstations use a proxy that connects to a security vendor's reputation service. The team wants to reduce false positives while keeping the analytic effective. Which action should they take?

Increase the alert severity so analysts pay more attention to the alerts.

Add the proxy server's IP to an allowlist in the analytic.

Disable the analytic until the proxy is reconfigured.

Exclude connections to the reputation service's domain from the analytic.

GIAC Security Operations Certified

Domain 3Objective 2

Analytic Design and Tuning GSOC Practice Questions (Page 11)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 51–51

51application · medium
A new analytic that flags 'outbound connections to known malicious IPs' is producing a high number of false positives because several workstations use a proxy that connects to a security vendor's reputation service. The team wants to reduce false positives while keeping the analytic effective. Which action should they take?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Analytic Design and Tuning GSOC Practice Questions (Page 11)

Questions 51–51

Keep studying — Incident Response and Optimization