A SIEM alert flags a workstation for repeated failed logins. The workstation is a shared kiosk in a hospital lobby. Which contextual information would most improve the analyst's interpretation?

The kiosk's asset value and the fact that it is publicly accessible, which may explain benign login failures.

The operating system version of the kiosk, to determine patch level.

The name of the antivirus vendor installed on the kiosk.

The IP address of the SIEM collector that forwarded the event.

An analyst sees an alert for a malware signature on a workstation. The workstation's antivirus shows no infection, and the file that triggered the alert is a legitimate software updater. What is the best validation step?

Disable the IDS signature to prevent future false positives.

Escalate to incident response because the signature is from a trusted vendor.

Quarantine the workstation immediately because the signature matched.

Check the file hash against a known-good database and review the process command line.

Why is structured event documentation important in security operations?

It reduces the need for security monitoring

It automatically blocks malicious IP addresses

It encrypts all log data at rest

It enables consistent reporting and future reference

A SOC receives an alert from a host-based EDR about a suspicious PowerShell command. The command is obfuscated. The analyst also sees a firewall log showing an outbound connection to a rare external IP. Which combination of sources provides the strongest evidence for a true positive?

Neither, because obfuscated PowerShell is common in administrative scripts.

EDR alert alone, because EDR is highly reliable.

EDR alert plus the firewall log showing the outbound connection to the rare IP.

Firewall log alone, because outbound connections to rare IPs are always suspicious.

GIAC Security Operations Certified

Domain 2Objective 4

Interpreting Events GSOC Practice Questions (Page 6)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 26–30

26application · medium
A SIEM alert flags a workstation for repeated failed logins. The workstation is a shared kiosk in a hospital lobby. Which contextual information would most improve the analyst's interpretation?
Select an answer first
27application · medium
An analyst sees an alert for a malware signature on a workstation. The workstation's antivirus shows no infection, and the file that triggered the alert is a legitimate software updater. What is the best validation step?
Select an answer first
28foundation · easy
Why is structured event documentation important in security operations?
Select an answer first
29foundation · easy
An IDS alert fires for a known exploit, but investigation shows the target system is not vulnerable. How should this alert be classified?
Select an answer first
30expert · hard
A SOC receives an alert from a host-based EDR about a suspicious PowerShell command. The command is obfuscated. The analyst also sees a firewall log showing an outbound connection to a rare external IP. Which combination of sources provides the strongest evidence for a true positive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.