Blue Team Defense Concepts GSOC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An incident responder is analyzing a compromised server. The responder has identified the malware and its persistence mechanism. The responder must decide whether to remove the malware immediately or preserve the system for further forensic analysis. The organization has a legal hold on the system. What is the BEST course of action?

   • APreserve the system and perform a full forensic image before any removal
   • BWait for the legal department to decide before taking any action
   • CRemove the malware immediately to prevent further damage
   • DRemove the malware but document the process for later analysis
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which technology is specifically designed to detect and respond to threats on individual endpoints?

   • AVulnerability scanner
   • BIntrusion Detection System (IDS)
   • CEndpoint Detection and Response (EDR)
   • DFirewall
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst notices a large volume of outbound DNS queries from a single internal host to a domain that was recently registered. The domain is not on any blocklist. What is the most appropriate next step for the analyst?

   • AEscalate to the incident response team for a full investigation
   • BIgnore the alert because the domain is not on a blocklist
   • CInvestigate the host's process tree and network connections to determine if the DNS activity is legitimate
   • DImmediately block the domain at the firewall
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an active ransomware incident, the incident commander decides to disconnect the affected servers from the network but does not power them off. The goal is to preserve forensic evidence while stopping the spread. Which defensive strategy is being applied?

   • ALayering
   • BContainment
   • CRecovery
   • DEradication
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security operations center is overwhelmed with alerts from its SIEM, many of which are false positives. The team is missing critical alerts buried in the noise. Which approach would MOST effectively improve the signal-to-noise ratio while maintaining good detection coverage?

   • AIncrease the severity threshold for all alerts so only high-severity events are generated.
   • BAdd more data sources to the SIEM to provide more context for every alert.
   • CDisable all correlation rules and rely on raw log review by analysts.
   • DTune the SIEM correlation rules to reduce known false positives and prioritize alerts based on asset criticality.
   Reveal Solution Discussion Select an answer first