Managing Alert Creation and Processing GSOM Practice Questions (Page 10)

Questions 46–48

1. 46foundation · easy

   Why is it important to document the expected behavior and response actions for an alert?

   • ATo provide guidance to analysts for consistent and efficient handling of the alert
   • BTo automatically resolve the alert
   • CTo increase the severity of the alert
   • DTo hide the alert from junior analysts
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which factor is most important when assigning severity to an alert?

   • AThe potential impact on the organization if the alert indicates a real threat
   • BThe time of day the alert was generated
   • CThe name of the alert rule
   • DThe number of false positives the alert has generated in the past
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A detection engineer creates an alert that triggers when a user accesses more than 50 files in a shared folder within 5 minutes. The alert is intended to detect mass data harvesting. In testing, the alert fires for a legitimate backup process that runs on a service account. The SOC manager must decide how to tune the alert. Which action is most appropriate?

   • ADisable the alert because the backup process is legitimate.
   • BChange the alert to only monitor interactive logon sessions.
   • CIncrease the threshold to 500 files to avoid the backup process.
   • DAdd an exception for the backup service account and keep the threshold for all other users.
   Reveal Solution Discussion Select an answer first