Blue Team Defense Concepts GSOC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security operations center is implementing a new monitoring strategy. They have a SIEM that collects logs from firewalls, servers, and applications. They are considering adding a new data source: NetFlow from their core routers. The team's goal is to improve their ability to detect data exfiltration. Which statement BEST describes the value of adding NetFlow?

   • ANetFlow is redundant with firewall logs and provides no additional value.
   • BNetFlow provides full packet capture, allowing for deep inspection of the data being exfiltrated.
   • CNetFlow provides metadata about network flows, which can help identify large or unusual data transfers that may indicate exfiltration.
   • DNetFlow is only useful for detecting malware infections, not data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the primary objective of a blue team in security operations?

   • ATo simulate adversarial attacks and identify exploitable weaknesses in the environment
   • BTo manage the organization's public cloud infrastructure and ensure cost efficiency
   • CTo defend the organization's systems and networks by detecting, analyzing, and responding to security threats
   • DTo design and implement offensive security tools for penetration testing engagements
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security operations team is reviewing threat intelligence from multiple sources. Source A is a commercial feed that provides IOCs with high confidence but is often delayed by several days. Source B is an open-source feed that provides IOCs in near real-time but has a high false-positive rate. The team has limited resources and cannot process all alerts. Which strategy BEST balances the need for timely detection with the need for accuracy?

   • AUse Source A for automated blocking and Source B for alerting only.
   • BUse Source B exclusively and block all IOCs immediately.
   • CUse Source A exclusively and ignore Source B to reduce noise.
   • DUse Source B for real-time blocking and Source A for manual investigation.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In defensive strategy, what is the primary purpose of defense in depth (layering)?

   • ATo eliminate the need for continuous monitoring by implementing strong preventive controls
   • BTo ensure that if one security control fails, additional controls are in place to protect the asset
   • CTo ensure that all security controls are implemented at the network perimeter
   • DTo reduce the number of security tools needed by consolidating them into a single platform
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst detects a single workstation beaconing to a known C2 domain. The malware is memory-resident and has not persisted to disk. The analyst isolates the host, captures a memory image, and kills the malicious process. According to the incident response lifecycle, which phase is the analyst performing when they terminate the process?

   • AContainment
   • BDetection
   • CRecovery
   • DEradication
   Reveal Solution Discussion Select an answer first