Managing Alert Creation and Processing GSOM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An alert for 'new local admin account created' is generating alerts for every new account, including those created by the IT team for legitimate purposes. The SOC manager wants to reduce false positives without missing malicious account creation. Which tuning action is most appropriate?

   • AChange the alert to only trigger when the account is added to the Domain Admins group.
   • BIncrease the severity to Critical so that analysts investigate every alert more thoroughly.
   • CCreate an allowlist of IT team accounts and processes that are authorized to create local admin accounts.
   • DDisable the alert because the IT team creates accounts regularly.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is creating an alert to detect the use of a known C2 framework. The framework uses a unique user-agent string and a specific beacon interval. The team wants to implement the alert with minimal false positives. Which detection logic is most appropriate?

   • ATrigger on any traffic to the C2 domain.
   • BTrigger on the unique user-agent string alone.
   • CTrigger when both the unique user-agent string and the beacon interval pattern are observed from the same host.
   • DTrigger on the beacon interval alone.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In alert lifecycle management, what is the typical final step after an alert has been fully investigated and resolved?

   • AClosing the alert with a detailed resolution note
   • BEscalating the alert to a higher tier
   • CReopening the alert for further analysis
   • DDeleting the alert from the system
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An alert indicates a possible ransomware infection on a server that hosts the company's customer database. What severity level is most appropriate?

   • AMedium
   • BHigh
   • CLow
   • DInformational
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC has an alert for 'privileged account login from a new device'. The alert is generating many false positives because users frequently log in from new devices. The SOC manager wants to reduce false positives while maintaining detection of truly anomalous logins. Which approach is the best trade-off?

   • AImplement a risk-based scoring model that considers multiple factors such as device reputation, location, and time, and only alert on high-risk combinations.
   • BOnly alert when the login occurs from a foreign country.
   • CDisable the alert because new device logins are common and not a reliable indicator.
   • DIncrease the severity to Critical so analysts investigate every new device login.
   Reveal Solution Discussion Select an answer first