Interpreting Events GSOC Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A SOC analyst is investigating a potential insider threat. The analyst has the following events: (1) a firewall log showing a user accessing a file-sharing website, (2) a host log showing the user copying files to a USB drive, and (3) an HR report that the user is about to be terminated. The analyst must decide whether to escalate this to incident response. Which action is most appropriate?

   • ACorrelate the events with the user's normal behavior and the HR context to determine if the activity is suspicious.
   • BIgnore the events because the user has legitimate access to the files and the file-sharing website.
   • CEscalate immediately because the user is about to be terminated, making any unusual activity a security incident.
   • DBlock the user's access to the file-sharing website and USB ports immediately.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An IDS alerts on outbound traffic from a web server to an IP listed on a threat intelligence feed. The analyst checks the web server logs and finds the traffic was a response to a user request for a legitimate third-party API. What should the analyst do?

   • ABlock the IP at the firewall immediately to prevent potential malware communication.
   • BEscalate the alert to incident response because the IP is on a threat intelligence feed.
   • CIgnore the alert because threat intelligence feeds are often outdated.
   • DValidate the alert by correlating with web server logs and then close it as a false positive if the traffic matches expected API usage.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst is triaging three alerts: (1) an IDS alert for a port scan from an external IP, (2) a firewall alert for an outbound connection to a file-sharing site from a low-privilege user's workstation, and (3) a host log showing a failed login to a domain controller. The analyst has limited time and must prioritize which alert to investigate first. Which alert should be treated as the highest priority?

   • AThe failed login to the domain controller, because the target is a high-value asset and the event may indicate a brute-force attack.
   • BAll three alerts equally, because every alert must be investigated in the order it was received.
   • CThe port scan, because scans are always the first step in an attack and should be blocked immediately.
   • DThe outbound connection to the file-sharing site, because data exfiltration is always the highest risk.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst sees a firewall log showing a blocked outbound connection to a known command-and-control IP. Separately, a host log shows a process making repeated DNS queries to a domain that resolves to that IP. What does the correlation suggest?

   • AThe DNS queries are benign because the domain may be legitimate.
   • BThe host is clean because the firewall prevented any communication.
   • CThe host is likely infected and attempting to communicate with C2, but the firewall is blocking it.
   • DThe firewall log is a false positive because the connection was blocked.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC analyst is triaging alerts and has limited time. The alerts are: (1) a low-severity IDS alert for a port scan, (2) a medium-severity alert for a malware signature on a user's workstation, and (3) a high-severity alert for a potential data exfiltration from a database server. Which alert should be investigated first?

   • AThe port scan alert, because scans are often the first step in an attack.
   • BAll three alerts simultaneously, because every alert must be investigated equally.
   • CThe malware signature alert, because malware can spread to other systems.
   • DThe data exfiltration alert, because it targets a high-value asset and has high potential impact.
   Reveal Solution Discussion Select an answer first