Managing Alert Creation and Processing GSOM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security engineer is tasked with creating an alert for detecting 'credential dumping' on Windows endpoints. The engineer has identified the relevant event IDs and has a draft detection rule. What is the next step in the alert creation workflow?

   • ADocument the alert in the runbook and notify the SOC team.
   • BAssign a severity level to the alert based on the criticality of the affected systems.
   • CDeploy the rule directly to production to start collecting data immediately.
   • DValidate the rule against a test environment with known credential dumping tools to confirm it triggers correctly.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC has a large backlog of open alerts. Many are low-priority and have been open for weeks. The SOC manager wants to reduce the backlog without increasing risk. Which strategy is the best trade-off?

   • AClose all alerts older than 30 days as false positives to clear the queue.
   • BIncrease the severity of all old alerts to force analysts to work them.
   • CImplement a triage process that categorizes alerts by severity and age, and close or escalate based on predefined criteria.
   • DHire more analysts to work through the backlog.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC manager is reviewing an alert that detects 'unusual outbound connection to a cloud storage service'. The alert fires for a developer who uses a personal cloud storage account to share large files with a client. The developer's activity is legitimate but violates company policy. The SOC manager wants to reduce false positives while still detecting policy violations and potential exfiltration. Which approach best balances these concerns?

   • AChange the alert to only fire for executives.
   • BDisable the alert because the activity is legitimate.
   • CKeep the alert active but add a note in the alert documentation that personal cloud storage use is a policy violation, and route the alert to the manager for review rather than treating it as a security incident.
   • DAdd an exception for the developer's account.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager is reviewing the documentation for a newly created alert that detects suspicious logon behavior. The alert documentation currently lists the rule name, the triggering condition, and the severity. Which additional element is most important to include for effective communication to on-call analysts?

   • AThe total number of times the alert has fired in the past month.
   • BThe name of the engineer who created the alert.
   • CA clear triage playbook that specifies which data sources to check and what actions to take for a true positive.
   • DThe exact time the alert was created.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC has an alert that detects 'suspicious PowerShell activity' and it fires frequently for a legitimate IT automation script. The SOC manager wants to reduce false positives but is concerned that suppressing the script entirely could hide malicious use of the same script. The script is signed by the IT department and runs from a specific server. Which approach best balances false-positive reduction and detection of malicious use?

   • AChange the alert to only fire when the script runs on domain controllers.
   • BSuppress the alert for the script's hash everywhere.
   • CAdd a suppression rule that excludes the signed script when it runs from the specific server, but keep the alert active for the same script running from any other host.
   • DDisable the alert entirely.
   Reveal Solution Discussion Select an answer first