A security engineer is designing a new security architecture for a small business. The business has a limited budget and cannot afford a full SIEM or a dedicated security team. The engineer needs to implement a basic defensive strategy that provides a reasonable level of protection. Which approach is the MOST practical for this scenario?

Implement a next-generation firewall and enable endpoint protection on all workstations.

Rely on the internet service provider's security features for all protection.

Deploy a full SIEM solution and hire a team of security analysts to monitor it.

Implement a complex multi-layered defense with multiple security tools.

A company's security team is evaluating a new EDR solution. The team's primary requirement is to have visibility into process execution, file modifications, and network connections on endpoints, and to be able to respond to threats by isolating a machine or killing a process. Which capability is MOST important for the EDR solution to have?

Continuous endpoint telemetry collection and remote response actions

Signature-based detection of known malware files

Network traffic analysis and intrusion prevention

Centralized log management and correlation

A SOC monitors a financial institution's network. The team receives a threat intelligence feed indicating a new banking trojan uses PowerShell to download a payload from a specific URL pattern. The SOC has a SIEM and EDR deployed. Which action best leverages the intelligence to improve detection?

Send the threat intel to the IT team for awareness without configuring any detection

Wait for the EDR vendor to update signatures before taking action

Block all PowerShell usage across the organization to prevent the trojan

Create a SIEM correlation rule that alerts on PowerShell process creation with command-line arguments matching the URL pattern

A security team is evaluating new security tools. They need a tool that can provide real-time visibility into network traffic and also allow them to replay historical traffic for analysis. Which tool best meets this requirement?

Intrusion Detection System (IDS) with alerting only

Network Traffic Analysis (NTA) tool with full packet capture capability

Security Information and Event Management (SIEM) with log aggregation

Endpoint Detection and Response (EDR) with endpoint telemetry

GIAC Security Operations Certified

Domain 1Objective 1

Blue Team Defense Concepts GSOC Practice Questions (Page 9)

Part of the Security Operations Fundamentals domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 5–8 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 41–45

41application · medium
A security engineer is designing a new security architecture for a small business. The business has a limited budget and cannot afford a full SIEM or a dedicated security team. The engineer needs to implement a basic defensive strategy that provides a reasonable level of protection. Which approach is the MOST practical for this scenario?
Select an answer first
42application · medium
A company's security team is evaluating a new EDR solution. The team's primary requirement is to have visibility into process execution, file modifications, and network connections on endpoints, and to be able to respond to threats by isolating a machine or killing a process. Which capability is MOST important for the EDR solution to have?
Select an answer first
43application · medium
A SOC monitors a financial institution's network. The team receives a threat intelligence feed indicating a new banking trojan uses PowerShell to download a payload from a specific URL pattern. The SOC has a SIEM and EDR deployed. Which action best leverages the intelligence to improve detection?
Select an answer first
44foundation · easy
Which stakeholder would a blue team most likely need to communicate with during a data breach involving customer data?
Select an answer first
45expert · hard
A security team is evaluating new security tools. They need a tool that can provide real-time visibility into network traffic and also allow them to replay historical traffic for analysis. Which tool best meets this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Blue Team Defense Concepts GSOC Practice Questions (Page 9)

Questions 41–45

A SOC monitors a financial institution's network. The team receives a threat intelligence feed indicating a new banking trojan uses PowerShell to download a payload from a specific URL pattern. The SOC has a SIEM and EDR deployed. Which action best leverages the intelligence to improve detection?

Which stakeholder would a blue team most likely need to communicate with during a data breach involving customer data?

A security team is evaluating new security tools. They need a tool that can provide real-time visibility into network traffic and also allow them to replay historical traffic for analysis. Which tool best meets this requirement?

Keep studying — Security Operations Fundamentals