Managing Alert Creation and Processing GSOM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When tuning an alert that has a high false positive rate, which approach best maintains detection coverage?

   • AAdding an exception for known benign activity that matches the alert pattern
   • BIncreasing the severity of the alert to attract more attention
   • CSuppressing all alerts from the affected data source
   • DDeleting the alert rule and creating a new one from scratch
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An alert for 'data exfiltration via DNS' fires for a workstation. The analyst investigates and finds that a legitimate monitoring agent uses DNS to send telemetry. The analyst closes the alert as a false positive. The SOC manager wants to ensure this alert is handled consistently in the future. What should the SOC manager do?

   • AAsk the analyst to send an email to the team explaining the finding.
   • BDocument the false-positive pattern in the alert's runbook and add a suppression rule for the monitoring agent's source IP or domain.
   • CChange the alert to only fire for servers, not workstations.
   • DLeave the alert unchanged and rely on analysts to remember the pattern.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC has an alert that detects a single failed login to a domain admin account. The alert fires occasionally for a known administrator who mistypes their password. The SOC manager wants to assign a severity that balances the potential impact of a compromised admin account with the likelihood of false positives. Which severity is most appropriate?

   • AInformational, because no successful login occurred.
   • BMedium, because the target account is highly privileged but the activity could be benign.
   • CCritical, because any failed login to a domain admin account is a serious threat.
   • DLow, because it is just a failed login.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC has an alert that detects PowerShell downloading an executable from an external URL. The alert fires frequently for a legitimate internal tool that uses PowerShell to fetch updates from a vendor CDN. The team wants to reduce noise without losing visibility into malicious PowerShell downloads. Which action best balances false-positive reduction and detection coverage?

   • ALower the severity to Informational and leave the rule unchanged.
   • BAdd an allowlist for the vendor CDN domain and the specific internal tool's hash, and keep the alert active for all other external URLs.
   • CChange the alert to only trigger on downloads from IP addresses outside the United States.
   • DDisable the alert entirely because the internal tool is legitimate.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC has an alert that detects a user account being locked out multiple times. The alert fires frequently for a specific user who forgets their password. The SOC manager wants to assign a severity that reflects the actual risk. Which severity is most appropriate for this alert?

   • ALow, because the activity is likely a user error and does not indicate a security incident.
   • BCritical, because account lockouts could indicate a brute-force attack.
   • CMedium, because the alert should be investigated but not escalated.
   • DHigh, because any account lockout is a potential security issue.
   Reveal Solution Discussion Select an answer first