During triage, when should an alert be escalated to a higher-level incident response team?

When the alert has been open for more than 24 hours

When the alert is a known false positive

When the alert was generated by a low-priority rule

When the alert involves a critical asset and shows evidence of active exploitation

After triaging an alert, an analyst determines that a user's machine was infected with adware that was downloaded from a malicious website. The analyst cleaned the machine and closed the alert. What documentation is most important to include in the incident record?

The user's name and the exact time the alert was closed.

The steps taken to clean the machine and the final disposition.

A summary of the alert and the user's explanation for the download.

The IP address of the malicious website and the file hash of the adware.

A SOC wants to implement a triage automation playbook. Which step should be automated first to have the most immediate impact on reducing analyst workload?

Automatically closing all low-severity alerts.

Automatically escalating all high-severity alerts to incident response.

Automating the enrichment of alerts with threat intelligence and asset criticality.

Automating the generation of reports for management.

What is the primary goal of validating an alert during triage analysis?

To assign a random priority to each alert

To increase the volume of alerts for the security team

To reduce false positives and confirm genuine threats

To delete all logs related to the alert

In a systematic alert triage process, which factor is typically considered FIRST when prioritizing an alert?

The reputation of the analyst who generated the alert

The color of the alert icon in the SIEM dashboard

The number of times the alert has fired in the past hour

The severity and potential impact of the alert on critical assets

GIAC Security Operations Certified

Domain 3Objective 1

Intrusion Triage and Analysis GSOC Practice Questions (Page 9)

Part of the Incident Response and Optimization domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–26 in this domain), expect 5–9 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41foundation · easy
During triage, when should an alert be escalated to a higher-level incident response team?
Select an answer first
42application · medium
After triaging an alert, an analyst determines that a user's machine was infected with adware that was downloaded from a malicious website. The analyst cleaned the machine and closed the alert. What documentation is most important to include in the incident record?
Select an answer first
43application · medium
A SOC wants to implement a triage automation playbook. Which step should be automated first to have the most immediate impact on reducing analyst workload?
Select an answer first
44foundation · easy
What is the primary goal of validating an alert during triage analysis?
Select an answer first
45foundation · easy
In a systematic alert triage process, which factor is typically considered FIRST when prioritizing an alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.