A SOC analyst is triaging an alert that indicates a single workstation has been beaconing to a known malicious domain. The workstation belongs to a user in the finance department. No other indicators of compromise have been found. What severity should the analyst assign?

Critical, because any connection to a malicious domain is an active breach.

Medium, because it is a single endpoint with a suspicious connection but no confirmed impact.

Low, because only one workstation is affected and no data loss has been confirmed.

High, because communication with a known malicious domain indicates a likely compromise and requires immediate investigation.

What is the purpose of the triage step in the alert lifecycle?

To quickly assess the alert and determine whether it is a true positive or false positive

To permanently close the alert without further investigation

To assign a severity level based solely on the alert's rule name

To update the alert rule's threshold values

In the alert creation workflow, which step typically follows the identification of a detection requirement?

Translating the requirement into a detection rule or query

Documenting the alert in the runbook

Deploying the alert to production immediately

An alert for 'SQL injection attempt' has been open for two weeks. The investigation has determined that the attempts were from a vulnerability scanner and were not successful. The analyst wants to close the alert. What should the analyst do before closing?

Document the investigation findings, including the source of the attempts and the conclusion that they were benign, and then close the alert.

Close the alert immediately because the investigation is complete.

Escalate the alert to management for approval to close.

Change the alert to exclude the vulnerability scanner's IP address before closing.

A SOC team has an alert that detects unusual outbound data transfers from a database server. During triage, an analyst determines the transfer was a scheduled backup to an approved cloud storage bucket. The analyst closes the alert as a false positive. The next week, the same alert fires for the same scheduled backup. What should the SOC manager do to prevent this recurring noise?

Update the alert logic to exclude transfers to the approved cloud storage bucket or add a suppression rule for that destination.

Instruct analysts to close the alert more quickly next time.

Increase the severity of the alert so it gets more attention.

Delete the alert because it has produced a false positive.

GIAC Security Operations Manager

Domain 2Objective 2

Managing Alert Creation and Processing GSOM Practice Questions (Page 1)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 1–5

1application · medium
A SOC analyst is triaging an alert that indicates a single workstation has been beaconing to a known malicious domain. The workstation belongs to a user in the finance department. No other indicators of compromise have been found. What severity should the analyst assign?
Select an answer first
2foundation · easy
What is the purpose of the triage step in the alert lifecycle?
Select an answer first
3foundation · easy
In the alert creation workflow, which step typically follows the identification of a detection requirement?
Select an answer first
4application · medium
An alert for 'SQL injection attempt' has been open for two weeks. The investigation has determined that the attempts were from a vulnerability scanner and were not successful. The analyst wants to close the alert. What should the analyst do before closing?
Select an answer first
5application · medium
A SOC team has an alert that detects unusual outbound data transfers from a database server. During triage, an analyst determines the transfer was a scheduled backup to an approved cloud storage bucket. The analyst closes the alert as a false positive. The next week, the same alert fires for the same scheduled backup. What should the SOC manager do to prevent this recurring noise?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.