Intrusion Triage and Analysis GSOC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During triage, an analyst finds a file hash that matches a known malware sample, but the file is signed by a legitimate software vendor and is present on all workstations. What should the analyst conclude?

   • AThe file is definitely malicious and all workstations are compromised.
   • BThe hash match is likely a false positive and should be validated with additional context.
   • CThe file is benign because it is signed by a legitimate vendor.
   • DThe file should be quarantined from all workstations immediately.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC has a limited number of analysts and a large queue of alerts. The team needs to prioritize alerts to ensure the most critical incidents are addressed first. Which factor should be the primary basis for prioritization?

   • AThe ease of investigation, with simpler alerts prioritized first.
   • BThe number of alerts from the same source, with more alerts prioritized.
   • CThe age of the alert, with older alerts prioritized first.
   • DThe potential impact on business operations and the criticality of the affected asset.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a primary benefit of using automation in the alert triage process?

   • AIt automatically patches all vulnerabilities
   • BIt improves efficiency and consistency by handling repetitive tasks
   • CIt completely eliminates the need for human analysts
   • DIt guarantees that no false positives will ever occur
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC team is overwhelmed by the volume of alerts. They are considering implementing an automated triage system that will automatically close low-confidence alerts. What is the primary risk of this approach?

   • AIt will slow down the triage process.
   • BIt may close true positives that do not meet the confidence threshold.
   • CIt will increase the number of false positives.
   • DIt will require more analysts to manage the system.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC analyst is triaging an alert that flagged an internal workstation communicating with a known-bad IP address from a threat intelligence feed. The analyst checks the DNS logs and sees the host resolved a domain that is not on any blocklist, and the connection was to port 443. The host is a development server that frequently runs scripts that pull external data. Which action best balances efficiency and accuracy?

   • AEscalate immediately because the IP is on a threat intel feed.
   • BCorrelate the alert with the host's historical behavior and the full network session before deciding.
   • CContain the host immediately to prevent potential data exfiltration.
   • DClose the alert as a false positive since the domain is not blocklisted.
   Reveal Solution Discussion Select an answer first