Intrusion Triage and Analysis GSOC Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   Which analytical technique is used to determine whether multiple alerts are related to a single attack campaign?

   • ALog archiving
   • BDisk defragmentation
   • CCorrelation analysis
   • DPassword reset
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An analyst is triaging an alert that flags a file hash as malicious. The file is found on a critical server, but the hash is also associated with a legitimate software update. The analyst has limited time and must decide. What is the most appropriate action?

   • AQuarantine the file immediately because it is on a critical server.
   • BClose the alert because the hash is associated with a legitimate update.
   • CEscalate as a critical incident because the file is on a critical server.
   • DCompare the file's metadata and digital signature with the legitimate software update.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst sees an alert for a known malicious IP in the firewall logs. Further review shows the IP is also listed in a threat intelligence feed as a scanning host. However, the destination was a honeypot and the traffic was blocked. What is the most appropriate triage decision?

   • AClose the alert as a false positive because the destination was a honeypot.
   • BContain the honeypot to prevent further scanning.
   • CEscalate as a high-priority incident because the IP is confirmed malicious.
   • DDocument the alert as a blocked scan with no impact and continue monitoring.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A SOC receives an alert that a user's machine is beaconing to an external IP every 60 seconds. The analyst checks the endpoint logs and sees that a legitimate software update service is running and has a scheduled task that checks for updates every minute. The external IP belongs to the software vendor's update server. Which decision is most appropriate?

   • ABlock the external IP in the firewall to prevent further communication.
   • BEscalate the alert because beaconing is always a sign of compromise.
   • CContain the host to stop the beaconing immediately.
   • DClose the alert as a false positive after confirming the communication matches the update service's behavior.
   Reveal Solution Discussion Select an answer first