Blue Team Defense Concepts GSOC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is communication with other teams important for a blue team during an incident?

   • ATo delegate all technical tasks to other teams
   • BTo satisfy regulatory requirements only
   • CTo keep the incident confidential and avoid unnecessary panic
   • DTo ensure that all teams are aware of the incident and can coordinate their response efforts
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is working on an incident where a user clicked on a malicious link in an email. The analyst has identified the malware and is now working to determine the scope of the infection by checking which other systems may have been accessed. Which phase of the incident response lifecycle is the analyst currently in?

   • AContainment
   • BEradication
   • CAnalysis
   • DRecovery
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security operations center receives a threat intelligence report indicating that a specific adversary group is actively exploiting a vulnerability in the company's public-facing web application. The report includes indicators of compromise (IOCs) such as specific IP addresses, user-agent strings, and file hashes. What is the MOST effective immediate action for the blue team to take based on this intelligence?

   • AShare the report with all employees and ask them to be vigilant for suspicious emails.
   • BCreate detection rules in the SIEM and IDS to alert on the provided IOCs and monitor for any matches.
   • CPatch the web application vulnerability immediately without testing.
   • DImmediately block all IP addresses listed in the report at the firewall without further analysis.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the incident response lifecycle, which phase comes immediately after detection and analysis?

   • ARecovery
   • BLessons Learned
   • CContainment
   • DPreparation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A blue team analyst sees an alert for a suspicious login from an IP address flagged by a commercial threat intel feed as a known proxy. The user's account is a standard user, and the login occurred outside business hours. The analyst must decide whether to escalate. Which consideration should be the PRIMARY factor in the escalation decision?

   • AThe user is a standard user, so the risk is low and no escalation is needed
   • BThe login is outside business hours and from a proxy, so escalate as a potential compromised account
   • CThe analyst should wait for additional failed logins before escalating
   • DThe IP address is on a threat intel list, so escalate immediately
   Reveal Solution Discussion Select an answer first