An analyst is triaging an alert about a possible brute-force attack on a VPN gateway. The analyst has access to the VPN logs, the authentication logs, and the firewall logs. Which data source would be most useful for confirming whether the brute-force attack succeeded?

Firewall logs, because they show network traffic to the VPN gateway.

VPN logs, because they show successful and failed VPN connections.

Threat intelligence feed, because it identifies the attacker's IP.

Authentication logs, because they show all logon attempts.

A SOC is designing an automated triage workflow. They want to reduce false positives while ensuring that no true positive is missed. Which approach best balances these goals?

Automatically block all IPs that appear in threat intelligence feeds.

Escalate all alerts to human analysts for manual review.

Use a scoring system that combines multiple signals and only closes alerts below a very low threshold.

Automatically close all alerts that do not match a known IOC.

Which type of indicator of compromise is most useful for identifying a specific malware variant across multiple systems?

The email address of a user in the organization

The IP address of a public web server

The hostname of a domain controller

A unique file hash of the malware binary

A SOC analyst is triaging an alert that shows a user account logging in from two different countries within 10 minutes. The user is a remote employee who frequently travels. The organization has a policy that requires escalation for impossible travel alerts, but the analyst knows the user has a legitimate VPN that routes through a different country. What should the analyst do?

Escalate the alert as required by policy, noting the VPN possibility in the ticket.

Close the alert as a false positive because the user has a VPN.

Ignore the alert because the user is a known traveler.

Contact the user to confirm their location before deciding.

A new SOC analyst is unsure which alerts to prioritize. The team has a queue with a critical server alert, a medium-severity alert on a user workstation, and a low-severity alert on a test machine. According to intrusion triage fundamentals, which alert should be handled first?

The medium-severity workstation alert, because it may involve user data.

The critical server alert, because it affects a high-value asset.

The low-severity test machine alert, because it can be resolved quickly.

All alerts equally, because each requires the same level of attention.

GIAC Security Operations Certified

Domain 3Objective 1

Intrusion Triage and Analysis GSOC Practice Questions (Page 3)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
An analyst is triaging an alert about a possible brute-force attack on a VPN gateway. The analyst has access to the VPN logs, the authentication logs, and the firewall logs. Which data source would be most useful for confirming whether the brute-force attack succeeded?
Select an answer first
12expert · hard
A SOC is designing an automated triage workflow. They want to reduce false positives while ensuring that no true positive is missed. Which approach best balances these goals?
Select an answer first
13foundation · easy
Which type of indicator of compromise is most useful for identifying a specific malware variant across multiple systems?
Select an answer first
14expert · hard
A SOC analyst is triaging an alert that shows a user account logging in from two different countries within 10 minutes. The user is a remote employee who frequently travels. The organization has a policy that requires escalation for impossible travel alerts, but the analyst knows the user has a legitimate VPN that routes through a different country. What should the analyst do?
Select an answer first
15application · medium
A new SOC analyst is unsure which alerts to prioritize. The team has a queue with a critical server alert, a medium-severity alert on a user workstation, and a low-severity alert on a test machine. According to intrusion triage fundamentals, which alert should be handled first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.