After triaging an alert, an analyst escalates it as a confirmed incident. The incident response team later determines the alert was a false positive. What should the analyst do?

Update the incident ticket with the final outcome and lessons learned.

Blame the analyst who created the alert.

Delete the incident ticket to avoid confusion.

Ignore the outcome because the incident is closed.

An analyst has just finished triaging an alert and determined that it was a false positive. The analyst needs to document the findings. What is the most important element to include in the documentation?

The analyst's personal opinion about the alert's importance.

The user's name and the time the alert was generated.

The reason why the alert was determined to be a false positive.

The exact steps to reproduce the false positive.

What is the purpose of assigning a confidence level to a security alert during triage?

To decide which security vendor's product to use for remediation

To indicate how certain the analyst is that the alert represents a genuine threat

To determine the exact financial cost of the incident

To calculate the number of hours needed for forensic analysis

Which of the following is an example of a behavioral indicator of compromise (IOC)?

A domain name used for phishing campaigns

An IP address of a command-and-control server

A file hash of a known malware executable

An unusual sequence of system API calls made by a process

During triage, an analyst confirms that a user's machine is exfiltrating data to an external IP. The user is a senior executive. What is the most appropriate immediate action?

Wait for the user to finish their work before taking action.

Send an email to the user asking if they are sending data.

Escalate to incident response and isolate the machine from the network.

Close the alert because the user is an executive and likely has legitimate reasons.

GIAC Security Operations Certified

Domain 3Objective 1

Intrusion Triage and Analysis GSOC Practice Questions (Page 5)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21expert · hard
After triaging an alert, an analyst escalates it as a confirmed incident. The incident response team later determines the alert was a false positive. What should the analyst do?
Select an answer first
22application · medium
An analyst has just finished triaging an alert and determined that it was a false positive. The analyst needs to document the findings. What is the most important element to include in the documentation?
Select an answer first
23foundation · easy
What is the purpose of assigning a confidence level to a security alert during triage?
Select an answer first
24foundation · easy
Which of the following is an example of a behavioral indicator of compromise (IOC)?
Select an answer first
25application · medium
During triage, an analyst confirms that a user's machine is exfiltrating data to an external IP. The user is a senior executive. What is the most appropriate immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.