Blue Team Defense Concepts GSOC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of continuous security monitoring?

   • ATo replace the need for periodic security assessments
   • BTo ensure that all security patches are applied automatically
   • CTo eliminate the risk of security breaches
   • DTo identify and respond to security threats in a timely manner
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A company experiences a data breach. The incident response team is in the 'lessons learned' phase. The team identifies that the SOC did not have a clear escalation path for alerts that were initially classified as low priority. The team wants to implement a process improvement. What is the most effective action?

   • AIncrease the frequency of all-alert reviews to every hour
   • BDisable all low-priority alerts to reduce noise
   • CAssign a senior analyst to review all alerts before they are closed
   • DCreate a formal escalation matrix that defines criteria for re-evaluating low-priority alerts and a clear chain of command
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A threat intelligence platform provides the SOC with a report on a new malware family. The report includes a list of IOCs, but the SOC's SIEM does not have any rules for these IOCs. The SOC also has limited resources and must decide how to prioritize the implementation of new detection rules. What is the MOST important factor to consider when prioritizing?

   • AThe relevance of the malware to the organization's industry and environment
   • BThe reputation of the threat intelligence vendor
   • CThe number of IOCs in the report
   • DThe age of the threat intelligence report
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security architect is designing a defense-in-depth strategy for a financial services company. The company handles highly sensitive customer data and must protect against both external attackers and insider threats. Which approach BEST exemplifies the principle of layering?

   • AImplement a strong password policy and require multi-factor authentication for all users.
   • BConduct regular security awareness training for all employees.
   • CPurchase a comprehensive SIEM solution and rely on it for all security monitoring.
   • DDeploy a next-generation firewall at the perimeter and an EDR solution on all endpoints.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   During an incident, what is the goal of containment?

   • ATo limit the spread and impact of the incident while preserving evidence
   • BTo identify the root cause of the incident
   • CTo restore affected systems to normal operation
   • DTo permanently remove the threat from the environment
   Reveal Solution Discussion Select an answer first