Interpreting Events GSOC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC receives three alerts: (1) a low-severity IDS alert for a port scan from an external IP, (2) a medium-severity alert for a malware signature on a user's workstation, and (3) a high-severity alert for a potential privilege escalation on a domain controller. The analyst has time to investigate only one alert. Which alert should be investigated first?

   • AThe malware signature on the workstation, because malware is always a serious threat.
   • BAll three alerts simultaneously, because every alert must be investigated equally.
   • CThe port scan, because scans are often the first step in an attack.
   • DThe privilege escalation on the domain controller, because it targets a critical asset and has high potential impact.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst sees two events: a firewall log showing an outbound connection from a finance workstation to a known malware domain, and an IDS alert for a signature matching that domain. The workstation belongs to the CFO, whose account has elevated access to financial systems. Which action best applies event prioritization principles?

   • AEscalate immediately because the asset is high-value and the two events corroborate a likely compromise.
   • BWait for additional events before any action because a single outbound connection is not enough to confirm a compromise.
   • CClose both events as false positives because the IDS signature is old and the firewall log alone is not proof of infection.
   • DNotify the CFO and ask them to run an antivirus scan, then close the ticket if the scan is clean.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst is reviewing an alert that shows a user account downloading a large file from an internal file server. The user is a junior accountant. The analyst must decide whether this is a security incident. Which additional context would be most valuable in making this decision?

   • AThe user's manager's name, to ask for approval of the download.
   • BThe file server's IP address, to verify that it is the correct internal server.
   • CThe exact file size in bytes, to determine if the download is unusually large.
   • DThe user's role and normal working hours, to determine if the activity is consistent with their job duties.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing logs and sees a single failed login attempt from an internal IP to a server. There are no other events. What is the most appropriate interpretation?

   • AIt is a false positive and can be ignored completely.
   • BIt is a low-severity event that may be a typo or misconfiguration, and should be monitored for patterns.
   • CIt is a definite brute-force attack and should be escalated immediately.
   • DIt is a critical incident because any failed login indicates a security issue.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is investigating a potential data breach. The analyst has the following events: (1) a firewall log showing an outbound connection to a cloud storage service from a server in the HR department, (2) a host log showing a large file compression activity on the same server, and (3) an IDS alert for a known data exfiltration tool signature. The analyst must determine if these events are related. Which approach is most effective?

   • AIgnore the firewall and host logs because they are not directly related to data exfiltration.
   • BPrioritize the IDS alert over the other events because signature matches are always the most reliable.
   • CCorrelate the events by source IP, time window, and user account to identify a common thread.
   • DTreat each event as an independent incident and investigate them separately.
   Reveal Solution Discussion Select an answer first