Blue Team Defense Concepts GSOC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a major incident, the SOC needs to coordinate with the legal department, public relations, and executive leadership. The incident commander is receiving conflicting instructions: legal wants to preserve all evidence, PR wants to minimize public disclosure, and executives want to restore services quickly. What is the BEST way for the incident commander to handle these conflicting priorities?

   • AFacilitate a meeting with all stakeholders to align on priorities and establish a unified response plan
   • BMake a unilateral decision and inform the stakeholders afterward
   • CPrioritize the executive's request to restore services quickly, as business continuity is most important
   • DFollow legal's advice exclusively to avoid legal liability
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which method is commonly used for continuous security monitoring?

   • AAnnual penetration testing
   • BReal-time log analysis using a SIEM
   • CQuarterly vulnerability scanning
   • DManual review of firewall rules
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A blue team is conducting a post-incident review. The team identifies that the SOC analyst who first detected the incident did not escalate it because they were unsure if the alert was a true positive. The team wants to improve the detection and escalation process. What is the MOST effective improvement?

   • AImplement a peer-review process where a second analyst validates alerts before they are closed
   • BAutomate the escalation of all alerts to the incident response team
   • CProvide more training to analysts on the specific threat
   • DIncrease the severity of all alerts to ensure they are escalated
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of using threat intelligence in defensive operations?

   • AUpdating firewall rules to block IP addresses known to be associated with a recent campaign
   • BReviewing access logs to identify unauthorized access attempts
   • CConducting a phishing simulation to test employee awareness
   • DPerforming a vulnerability scan to identify missing patches
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary function of a Security Information and Event Management (SIEM) system?

   • ATo block malicious network traffic in real time
   • BTo aggregate and analyze log data from multiple sources for security monitoring
   • CTo manage user identities and access permissions
   • DTo scan endpoints for malware and quarantine infected files
   Reveal Solution Discussion Select an answer first