Intrusion Triage and Analysis GSOC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After triaging an alert, an analyst determines that a user's machine was infected with ransomware, and the machine has been isolated. The analyst needs to communicate the findings to the management. What is the most important information to include in the communication?

   • AThe list of all files that were encrypted by the ransomware.
   • BThe user's name and the exact time the alert was generated.
   • CThe technical details of the ransomware family and the file hash.
   • DThe impact on business operations and the actions taken to contain the incident.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst sees an alert for a suspicious PowerShell command on a server. The command is obfuscated and the server is internet-facing. What is the best next step?

   • AClose the alert because PowerShell is commonly used by administrators.
   • BDisable PowerShell on the server to prevent further abuse.
   • CEscalate immediately as a critical incident without further analysis.
   • DCorrelate the alert with process creation logs and network connections from the server.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC team is overwhelmed by the volume of alerts. They want to implement automation to reduce the workload. Which automation strategy is most effective for improving triage efficiency without sacrificing accuracy?

   • ARoute all alerts to a single analyst for manual review.
   • BUse automation to enrich alerts with threat intelligence and correlate them with other alerts.
   • CAutomatically escalate all alerts that match a high-severity rule.
   • DAutomatically close all alerts that have not been reviewed within 24 hours.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC is triaging an alert that a user's workstation made an outbound connection to a suspicious domain. The analyst has access to the firewall logs, the endpoint's process execution logs, and the threat intelligence feed that flagged the domain. Which combination of data sources would most efficiently confirm or refute the alert?

   • AEndpoint process execution logs only
   • BFirewall logs, endpoint process execution logs, and threat intelligence feed
   • CFirewall logs and threat intelligence feed only
   • DEndpoint process execution logs and threat intelligence feed only
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is triaging an alert on a domain controller. The alert indicates a successful logon from a foreign IP address at 3:00 AM using a service account that has never logged on from that IP. The organization's policy requires immediate containment for any suspected compromised privileged account, but the analyst also sees that the account is used by a scheduled backup job that runs from a cloud provider. The backup job's documentation states it uses a different IP range. What should the analyst do first?

   • AClose the alert as a false positive because the account is used by a scheduled job.
   • BEscalate to the incident response team without further analysis.
   • CVerify the logon against the backup job's documented IP range and recent authentication logs.
   • DContain the account immediately per policy, then investigate the logon.
   Reveal Solution Discussion Select an answer first