Which data source is most likely to provide real-time visibility into network connections and data transfers during triage?

Endpoint antivirus scan reports

A SOC handles thousands of low-severity alerts daily. The team wants to reduce the time spent on repetitive triage tasks while maintaining accuracy. Which approach best achieves this goal?

Automate the closure of all low-severity alerts without analyst review.

Assign all low-severity alerts to junior analysts for manual review.

Create automated playbooks that enrich alerts with threat intelligence and suppress known false positives.

Increase the alert threshold to reduce the number of alerts generated.

When communicating triage findings to stakeholders, what is the most important characteristic of the communication?

It is clear and concise, tailored to the audience's level of technical expertise

It uses highly technical jargon to demonstrate expertise

It includes every raw log entry for completeness

It is delivered only verbally without any written record

After triaging an alert, an analyst determines that a user's machine is infected with malware and escalates the incident. What documentation should the analyst include in the incident ticket?

A summary of all alerts from the past week to provide context

Only the original alert details and the user's name

The alert details, triage steps taken, evidence collected, and rationale for escalation

The remediation steps already taken and the final root cause analysis

Which data source would provide the most detailed information about the processes running on a specific host during triage?

Endpoint detection and response (EDR) telemetry

GIAC Security Operations Certified

Domain 3Objective 1

Intrusion Triage and Analysis GSOC Practice Questions (Page 7)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 31–35

31foundation · easy
Which data source is most likely to provide real-time visibility into network connections and data transfers during triage?
Select an answer first
32application · medium
A SOC handles thousands of low-severity alerts daily. The team wants to reduce the time spent on repetitive triage tasks while maintaining accuracy. Which approach best achieves this goal?
Select an answer first
33foundation · easy
When communicating triage findings to stakeholders, what is the most important characteristic of the communication?
Select an answer first
34application · medium
After triaging an alert, an analyst determines that a user's machine is infected with malware and escalates the incident. What documentation should the analyst include in the incident ticket?
Select an answer first
35foundation · easy
Which data source would provide the most detailed information about the processes running on a specific host during triage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.