An analytic that flags 'multiple failed logons followed by a successful logon' is generating hundreds of alerts per day. A review shows most alerts are from a single legacy application that retries authentication with a service account every 15 minutes. The team wants to reduce noise without missing a real brute-force attack. Which tuning action should be taken first?

Shorten the time window from 15 minutes to 5 minutes.

Add a filter to exclude the legacy application's service account from the analytic.

Increase the failed-logon threshold from 5 to 20 within the same time window.

Create a separate baseline for the legacy application and apply a higher threshold only to that source.

A SOC is developing a use case to detect data exfiltration via DNS. The team has access to DNS query logs and firewall logs. They want to identify long subdomains with high entropy, which are indicative of tunneling. Which analytic design best translates this use case into a query?

Alert when a host makes more than 100 DNS queries per hour to any domain.

Alert when a single DNS query has a subdomain longer than 50 characters and an entropy score above a threshold.

Alert when a firewall log shows a connection to port 53 from a non-DNS server.

Alert when a DNS query resolves to an IP address in a foreign country.

Which of the following is a benefit of testing analytics in a test environment before production deployment?

It allows you to evaluate the analytic's behavior without affecting production operations

It guarantees the analytic will have zero false positives

It eliminates the need for tuning

It automatically optimizes the query for production

A SOC analyst has modified a critical analytic that detects ransomware activity. The change reduces false positives but also slightly changes the alert format. What is the most important communication step before deploying the change?

Notify the incident response team about the change and update the analytic's documentation to reflect the new behavior.

Wait until the next quarterly review to inform stakeholders.

Send an email to the entire company about the analytic change.

Only inform the SIEM administrator who will deploy the change.

A security team is designing an analytic to detect 'insider threat' activity. They have access to HR records, email metadata, and endpoint activity logs. The team is concerned about privacy and operational relevance. Which design principle should guide the analytic's scope?

Design the analytic to alert on any employee who accesses files outside their department.

Focus the analytic on specific behaviors that indicate a clear business risk, using only the data sources necessary to detect those behaviors.

Include all available data sources to maximize detection coverage.

Use only HR records because they are the most authoritative source.

GIAC Security Operations Certified

Domain 3Objective 2

Analytic Design and Tuning GSOC Practice Questions (Page 8)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 36–40

36application · medium
An analytic that flags 'multiple failed logons followed by a successful logon' is generating hundreds of alerts per day. A review shows most alerts are from a single legacy application that retries authentication with a service account every 15 minutes. The team wants to reduce noise without missing a real brute-force attack. Which tuning action should be taken first?
Select an answer first
37application · medium
A SOC is developing a use case to detect data exfiltration via DNS. The team has access to DNS query logs and firewall logs. They want to identify long subdomains with high entropy, which are indicative of tunneling. Which analytic design best translates this use case into a query?
Select an answer first
38foundation · easy
Which of the following is a benefit of testing analytics in a test environment before production deployment?
Select an answer first
39application · medium
A SOC analyst has modified a critical analytic that detects ransomware activity. The change reduces false positives but also slightly changes the alert format. What is the most important communication step before deploying the change?
Select an answer first
40application · medium
A security team is designing an analytic to detect 'insider threat' activity. They have access to HR records, email metadata, and endpoint activity logs. The team is concerned about privacy and operational relevance. Which design principle should guide the analytic's scope?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.