A network administrator notices a large number of failed SSH login attempts to a public-facing server from various IP addresses over the past hour. The administrator must determine whether this constitutes a security event that requires action. What is the most appropriate first step?

Immediately block all the source IP addresses to prevent further attempts.

Classify the event as a denial-of-service attack and escalate to incident response.

Validate the event by checking whether any of the attempts succeeded and whether the source IPs are known scanners.

Ignore the attempts because failed logins are common on public-facing servers.

Which element is typically included in structured event documentation?

The analyst's conclusion and recommended actions

The raw binary content of all network packets

The personal passwords of affected users

The vendor's marketing materials

What is the primary goal of event validation?

To assign a severity score to each event

To increase the number of alerts generated

To reduce false positives and false negatives

To store events in a central log repository

A SIEM shows two alerts: one for a failed login on a domain controller and one for a successful login from a new device for a service account. Which alert should be prioritized higher?

The failed login on the domain controller, because domain controllers are high-value targets.

Both equally, because both involve authentication events.

Neither, because authentication events are routine.

The successful login from a new device for a service account, because it may indicate credential misuse.

What is the main goal of event correlation?

To combine multiple events to identify patterns or incidents

To assign a severity score to each individual event

To delete duplicate events from the log store

To convert logs into a standardized format

GIAC Security Operations Certified

Domain 2Objective 4

Interpreting Events GSOC Practice Questions (Page 8)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 36–40

36application · medium
A network administrator notices a large number of failed SSH login attempts to a public-facing server from various IP addresses over the past hour. The administrator must determine whether this constitutes a security event that requires action. What is the most appropriate first step?
Select an answer first
37foundation · easy
Which element is typically included in structured event documentation?
Select an answer first
38foundation · easy
What is the primary goal of event validation?
Select an answer first
39application · medium
A SIEM shows two alerts: one for a failed login on a domain controller and one for a successful login from a new device for a service account. Which alert should be prioritized higher?
Select an answer first
40foundation · easy
What is the main goal of event correlation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.