Interpreting Events GSOC Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   After investigating a data breach, an analyst must document the event. The analyst has collected network logs, host logs, and interview notes from affected users. The analyst must create a report that will be used for legal proceedings. Which documentation practice is most important?

   • AEnsure the documentation is structured, complete, and preserves the chain of custody for all evidence.
   • BSend a brief email to the legal team summarizing the incident and then delete the evidence.
   • CStore the raw logs in a shared folder without any analysis or summary.
   • DVerbally report the incident to the legal team and rely on memory for future reference.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After investigating a phishing email that led to a credential entry on a fake login page, an analyst needs to document the findings. What is the most important element to include for future reference?

   • AThe number of employees who received the email, even if not all clicked.
   • BThe analyst's personal opinion about the sophistication of the phishing email.
   • CThe name of the email gateway vendor and its version.
   • DThe full email headers, the URL of the phishing page, and the timestamp of the credential submission.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst at a mid-sized company sees a firewall log entry showing an outbound connection from a finance workstation to a known malware distribution IP at 3:00 AM. Ten minutes later, the host-based IDS on that workstation logs a suspicious PowerShell process launching. The analyst must decide whether to escalate this to incident response. Which action best supports the interpretation of these events?

   • ACorrelate the firewall and host IDS events by source IP and time window to establish a potential infection chain.
   • BEscalate immediately based solely on the host IDS alert, ignoring the firewall log because host-based alerts are always more reliable.
   • CWait for additional alerts from the same workstation before taking any action, to avoid wasting incident response resources.
   • DTreat the firewall event as a false positive because outbound connections to known bad IPs are common in normal business traffic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An alert fires for a workstation that is part of a research lab handling sensitive intellectual property. The alert is a single outbound connection to a file-sharing site. How should the analyst use contextual information?

   • ATreat it as low priority because file-sharing sites are common and often benign.
   • BEscalate to law enforcement because intellectual property is involved.
   • CClose the alert immediately because one connection is not enough to confirm exfiltration.
   • DPrioritize the alert higher because the asset has high value and the activity may indicate data exfiltration.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After investigating a series of failed login attempts followed by a successful login from a foreign IP address, an analyst determines that the account was compromised. The analyst has completed the investigation and must document the findings. Which documentation practice is most important for future reference and reporting?

   • ASave only the raw logs from the firewall and authentication server, without any analysis notes.
   • BVerbally brief the security manager and then delete the temporary notes to protect sensitive information.
   • CRecord the event timeline, evidence collected, analysis steps, and the final conclusion in a structured incident report.
   • DEmail the findings to the incident response team but do not store them in a central repository.
   Reveal Solution Discussion Select an answer first