A SIEM alert flags a workstation for outbound traffic to a cloud storage service. The workstation belongs to a marketing employee. The marketing department frequently uses cloud storage for sharing large files. How should the analyst use context to decide?

Check if the cloud storage usage is consistent with the employee's role and typical behavior before escalating.

Block all cloud storage access for the marketing department to prevent data loss.

Ignore the alert because marketing employees often use cloud storage.

Escalate immediately because any cloud storage traffic is a data exfiltration risk.

Which of the following is a common source of security events?

Intrusion detection systems (IDS)

Which factor is most important when prioritizing security events?

The severity of the event and the impact on critical assets

The number of events received in the last hour

An event involves a potential malware infection on a domain controller. How should this event be prioritized compared to a similar event on a standard user workstation?

Higher, because the domain controller is a critical asset

Lower, because workstations are more numerous

It cannot be prioritized without more information

The same, because the malware is the same

What is the purpose of event contextualization?

To compress log files to save storage space

To remove false positives from the event stream

To automatically remediate security incidents

To enrich events with additional information to improve interpretation

GIAC Security Operations Certified

Domain 2Objective 4

Interpreting Events GSOC Practice Questions (Page 9)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 41–45

41expert · hard
A SIEM alert flags a workstation for outbound traffic to a cloud storage service. The workstation belongs to a marketing employee. The marketing department frequently uses cloud storage for sharing large files. How should the analyst use context to decide?
Select an answer first
42foundation · easy
Which of the following is a common source of security events?
Select an answer first
43foundation · easy
Which factor is most important when prioritizing security events?
Select an answer first
44foundation · easy
An event involves a potential malware infection on a domain controller. How should this event be prioritized compared to a similar event on a standard user workstation?
Select an answer first
45foundation · easy
What is the purpose of event contextualization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.