An analyst is triaging an alert that a host made a DNS query for a domain that is a known malware C2 domain. The analyst checks the proxy logs and sees that the host also downloaded a file from that domain. The file's hash is not in any threat intel feed. Which conclusion is most defensible?

The host is likely compromised because the domain is known malicious and the download occurred.

The alert is a false positive because the file hash is not known.

The host is not compromised because the file hash is unknown and the domain could be legitimate.

The alert should be escalated only if the file hash is in a threat intel feed.

In the context of incident response, what is the primary purpose of intrusion triage?

To automatically block all suspicious IP addresses without analyst review

To permanently remediate all detected vulnerabilities across the enterprise

To collect and preserve forensic evidence for potential legal proceedings

To quickly assess and prioritize alerts so that the most critical incidents receive attention first

Which tool is commonly used to automate the enrichment of alerts with threat intelligence during triage?

Security orchestration, automation, and response (SOAR) platform

An analyst is triaging an alert on a file server. The alert indicates that a user account was used to access a large number of files in a short time, which is unusual for that user. The analyst checks the authentication logs and sees that the logon came from a new IP address that is not in the user's normal pattern. The user is on vacation and has not responded to messages. What is the most appropriate action?

Disable the user account immediately to prevent further access.

Close the alert because the user might have used a VPN or a new device.

Wait for the user to return from vacation before taking any action.

Escalate the alert to the incident response team with the evidence gathered.

A SOC team wants to implement a tool that automatically enriches alerts with threat intelligence and checks the reputation of IP addresses and domains. Which benefit does this automation provide to the triage process?

It eliminates the need for human analysts in the triage process.

It increases the number of alerts generated by the SIEM.

It reduces the time analysts spend on repetitive enrichment tasks, allowing them to focus on complex analysis.

It guarantees that all false positives are automatically identified and closed.

GIAC Security Operations Certified

Domain 3Objective 1

Intrusion Triage and Analysis GSOC Practice Questions (Page 8)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 36–40

36expert · hard
An analyst is triaging an alert that a host made a DNS query for a domain that is a known malware C2 domain. The analyst checks the proxy logs and sees that the host also downloaded a file from that domain. The file's hash is not in any threat intel feed. Which conclusion is most defensible?
Select an answer first
37foundation · easy
In the context of incident response, what is the primary purpose of intrusion triage?
Select an answer first
38foundation · easy
Which tool is commonly used to automate the enrichment of alerts with threat intelligence during triage?
Select an answer first
39expert · hard
An analyst is triaging an alert on a file server. The alert indicates that a user account was used to access a large number of files in a short time, which is unusual for that user. The analyst checks the authentication logs and sees that the logon came from a new IP address that is not in the user's normal pattern. The user is on vacation and has not responded to messages. What is the most appropriate action?
Select an answer first
40application · medium
A SOC team wants to implement a tool that automatically enriches alerts with threat intelligence and checks the reputation of IP addresses and domains. Which benefit does this automation provide to the triage process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.