Interpreting Events GSOC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is correlating events from multiple sources. A firewall log shows a connection to a known malicious IP. A DNS log shows a query for a domain that resolves to that IP. A host log shows a process named 'svchost.exe' making the query. The host is a critical server. What is the most appropriate next step?

   • ABlock the IP at the firewall and close the incident.
   • BValidate the process path and command line to confirm if it is the legitimate svchost.exe or a masquerading process.
   • CDocument the events and move on because the connection was to a known malicious IP.
   • DImmediately isolate the server because it is critical and the IP is malicious.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which scenario best illustrates event correlation?

   • AA server reports high CPU usage
   • BA firewall log shows a denied inbound connection from an external IP
   • CAn IDS generates an alert for a known malware signature
   • DA user logs in, then downloads a large file, then the account is locked out
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst sees a series of events: a user receives a phishing email, clicks a link, downloads a file, and then the file executes. The antivirus does not detect the file. The user is in the HR department. What is the most appropriate action?

   • AOnly document the events and continue monitoring, because the user may have downloaded a legitimate file.
   • BQuarantine the email gateway to prevent further phishing emails.
   • CCorrelate the email, download, and execution events to confirm the attack chain, then isolate the workstation and escalate.
   • DClose the case because antivirus did not detect the file, so it is likely benign.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   After a multi-day incident, an analyst must create a report for management. The report should support both legal review and future detection improvements. What is the best approach?

   • AStore the report in a shared drive but do not include recommendations to avoid liability.
   • BFocus only on the remediation steps taken to show the incident is resolved.
   • CWrite a high-level summary without technical details to avoid overwhelming management.
   • DInclude a detailed timeline, all evidence with timestamps, and a summary of detection gaps and recommendations.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In network security, what is the primary purpose of event analysis?

   • ATo replace the need for security controls such as firewalls and IDS
   • BTo automatically block all suspicious traffic without human review
   • CTo identify and understand potential security incidents from raw data
   • DTo store logs for compliance purposes only
   Reveal Solution Discussion Select an answer first