During a security incident, the SOC identifies that a compromised account was used to access a database containing customer PII. The SOC needs to inform the database administrator (DBA) to check for unauthorized data exports. Which communication practice is most appropriate?

Wait until the incident is fully contained before informing the DBA

Call the DBA directly and provide a concise, need-to-know summary of the compromised account and the specific request to check for data exports

Post the details in a public team chat channel for maximum visibility

Send a detailed email to the DBA with all forensic evidence and the full incident timeline

During a major security incident, the incident response team discovers that the attacker has compromised a domain controller and is using it to authenticate to other systems. The team needs to contain the incident, but the domain controller is also critical for authentication across the entire organization. The CIO is hesitant to take the domain controller offline because it will cause a major outage. What is the BEST course of action?

Immediately shut down the domain controller and accept the outage.

Leave the domain controller online and monitor its activity closely.

Isolate the domain controller from the network while maintaining a secondary domain controller for authentication.

Reset the domain controller's password and continue operations.

A company's security team wants to detect and block known exploit attempts at the network perimeter before they reach internal servers. They also want to log all blocked attempts for later analysis. Which technology should they deploy?

Endpoint Detection and Response (EDR)

Intrusion Detection System (IDS)

Security Information and Event Management (SIEM)

Intrusion Prevention System (IPS)

A SOC is overwhelmed by a high volume of false positives from a new SIEM rule. The rule was designed to detect a specific threat, but it is triggering on normal administrative activity. The team must reduce the noise without losing the ability to detect the threat. What is the most effective approach?

Refine the rule to exclude known administrative accounts and processes while preserving the core detection logic

Increase the alert threshold to reduce the number of alerts

Disable the rule and rely on manual monitoring

Ignore the false positives and continue monitoring

A security analyst has confirmed a malware infection on a server that hosts a critical customer-facing application. The analyst has isolated the server and is now preparing to contain the incident. Who should the analyst involve in the containment decision to minimize business impact?

The application owner and the IT operations team

The end users of the application

The external penetration testing team

The legal department and public relations team

GIAC Security Operations Certified

Domain 1Objective 1

Blue Team Defense Concepts GSOC Practice Questions (Page 3)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 11–15

11application · medium
During a security incident, the SOC identifies that a compromised account was used to access a database containing customer PII. The SOC needs to inform the database administrator (DBA) to check for unauthorized data exports. Which communication practice is most appropriate?
Select an answer first
12expert · hard
During a major security incident, the incident response team discovers that the attacker has compromised a domain controller and is using it to authenticate to other systems. The team needs to contain the incident, but the domain controller is also critical for authentication across the entire organization. The CIO is hesitant to take the domain controller offline because it will cause a major outage. What is the BEST course of action?
Select an answer first
13application · easy
A company's security team wants to detect and block known exploit attempts at the network perimeter before they reach internal servers. They also want to log all blocked attempts for later analysis. Which technology should they deploy?
Select an answer first
14expert · hard
A SOC is overwhelmed by a high volume of false positives from a new SIEM rule. The rule was designed to detect a specific threat, but it is triggering on normal administrative activity. The team must reduce the noise without losing the ability to detect the threat. What is the most effective approach?
Select an answer first
15application · medium
A security analyst has confirmed a malware infection on a server that hosts a critical customer-facing application. The analyst has isolated the server and is now preparing to contain the incident. Who should the analyst involve in the containment decision to minimize business impact?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Blue Team Defense Concepts GSOC Practice Questions (Page 3)

Questions 11–15

During a security incident, the SOC identifies that a compromised account was used to access a database containing customer PII. The SOC needs to inform the database administrator (DBA) to check for unauthorized data exports. Which communication practice is most appropriate?

A company's security team wants to detect and block known exploit attempts at the network perimeter before they reach internal servers. They also want to log all blocked attempts for later analysis. Which technology should they deploy?

A security analyst has confirmed a malware infection on a server that hosts a critical customer-facing application. The analyst has isolated the server and is now preparing to contain the incident. Who should the analyst involve in the containment decision to minimize business impact?

Keep studying — Security Operations Fundamentals