Interpreting Events GSOC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst notices three events: a VPN login from a user's account at 2:00 AM, a successful RDP login to a file server at 2:10 AM, and a large data transfer from that file server to an external IP at 2:30 AM. What is the most appropriate interpretation?

   • ATreat each event independently because they involve different systems and protocols.
   • BCorrelate the events as a possible account compromise and data exfiltration, and initiate incident response.
   • CDocument the events but take no action because there is no malware signature.
   • DDismiss the events as normal because the user may be working late.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   After responding to a phishing incident, an analyst must document the event for future reference. The analyst has collected email headers, user reports, and the actions taken. Which documentation approach is most appropriate?

   • AVerbally report the incident to the manager and rely on memory for future reference.
   • BSend a brief email to the security team summarizing the incident and then delete the evidence.
   • CCreate a structured incident report that includes the timeline, evidence, analysis, and remediation steps.
   • DStore the raw email headers and user reports in a folder without any analysis or summary.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC has limited staffing and must triage a queue of alerts. One alert is a failed login on a public-facing VPN portal. Another is a successful login to a domain admin account from a new IP. A third is a malware signature match on a low-value printer. Which alert should be investigated first?

   • AThe failed login on the VPN portal, because it is publicly exposed.
   • BAll alerts equally, because each could be critical.
   • CThe successful login to a domain admin account from a new IP, because it indicates a likely compromise of a high-privilege account.
   • DThe malware signature on the printer, because malware can spread.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which piece of information is an example of contextual enrichment for a security event?

   • AThe asset value of the affected system
   • BThe source IP address of the event
   • CThe timestamp of the event
   • DThe raw packet capture of the event
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC receives an alert from a network-based IDS about a potential SQL injection attempt against a public web application. Which additional event source would provide the most direct evidence to validate the alert?

   • ADNS logs showing the domain resolution for the web application.
   • BFirewall logs showing the source IP and destination port.
   • CWeb server access logs showing the application's response to the request.
   • DAuthentication logs from the web application's user database.
   Reveal Solution Discussion Select an answer first