Intrusion Triage and Analysis GSOC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is accurate documentation of triage activities important in incident response?

   • AIt allows analysts to skip the triage process
   • BIt eliminates the need for further investigation
   • CIt ensures that all alerts are automatically resolved
   • DIt provides a record of decisions and actions that can be reviewed and used for improvement
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the appropriate action for an alert that, after thorough triage analysis, is determined to be a false positive?

   • AIgnore the alert and take no action
   • BReopen the alert every hour to ensure it is still false
   • CClose the alert with a clear rationale and update any relevant detection rules
   • DEscalate the alert to the executive team
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC team receives hundreds of low-level alerts daily, many of which are false positives. They want to reduce analyst workload while maintaining detection quality. Which approach best achieves this?

   • ADisable all low-level alerts to reduce noise.
   • BIncrease the sensitivity of all detection rules to catch more threats.
   • CRoute all alerts directly to the incident response team for faster handling.
   • DAutomate enrichment and correlation of alerts with threat intelligence and asset data.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which activity is most characteristic of the intrusion triage phase in incident response?

   • AConducting a full forensic analysis of every affected system
   • BInstalling security patches on all servers in the environment
   • CCategorizing alerts by severity and potential impact to determine response priority
   • DDeleting all logs that are older than 30 days to free up storage
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is triaging an alert that flags a domain name in a proxy log. The domain is newly registered and has no reputation. What is the most appropriate triage action?

   • AInvestigate the domain's DNS history and associated files or behavior.
   • BIgnore the alert because new domains are common.
   • CEscalate as a critical incident because the domain is unknown.
   • DBlock the domain immediately because it is newly registered.
   Reveal Solution Discussion Select an answer first