Managing Alert Creation and Processing GSOM Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC manager is reviewing an alert that detects 'possible data exfiltration' when a user uploads more than 100 MB of data to an external cloud storage service within an hour. The alert fires frequently for a marketing team that regularly uploads large video files to a vendor platform. The marketing team's activity is legitimate, but the SOC manager is concerned about missing real exfiltration. The SOC manager must decide how to tune the alert. Which approach best addresses the trade-off between false positives and detection coverage?

   • AChange the alert to only monitor users in the finance department.
   • BAdd an exception for the marketing team's source IPs and the vendor platform's domain, and keep the alert active for all other users and destinations.
   • CDisable the alert because the marketing team's activity is legitimate.
   • DIncrease the threshold to 1 GB per hour for all users.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A new alert for 'lateral movement using SMB' has been deployed. The SOC manager wants to ensure that all analysts understand how to respond to this alert. What is the most effective way to communicate this information?

   • ACreate a detailed runbook that includes the alert's trigger conditions, investigation steps, and escalation criteria, and make it available to all analysts.
   • BAdd the alert to the SIEM with a high severity so that analysts will pay attention.
   • CSend an email to all analysts describing the alert and asking them to read it.
   • DHold a one-time training session on the alert and do not provide written documentation.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC team has an alert for 'DNS tunneling' that is generating a high volume of alerts. Analysis shows that most alerts are from a third-party monitoring tool that uses DNS for updates. The team has limited resources and cannot manually review all alerts. The SOC manager must balance reducing false positives with maintaining detection of actual DNS tunneling. Which approach is the best trade-off?

   • ADisable the alert and rely on manual log reviews for DNS tunneling.
   • BKeep the alert as is and assign a dedicated analyst to filter out false positives manually.
   • CExclude the monitoring tool's domains and IP addresses from the alert, and add a separate low-priority alert to monitor for changes in the tool's behavior.
   • DIncrease the alert threshold to require a higher volume of DNS queries before triggering.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When a critical alert is escalated to management, what information is most important to communicate?

   • AThe number of false positives the alert has generated
   • BThe names of the analysts who triaged the alert
   • CThe potential impact and current response status
   • DThe exact log source and query used in the alert rule
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A new alert for 'unusual outbound data transfer' has been deployed. During the first week, it generated 50 alerts, of which 45 were false positives caused by a backup system. The SOC manager wants to communicate the alert's performance to stakeholders. What should the manager report?

   • AThe alert is a failure and should be disabled immediately.
   • BThe alert is working well because it generated 50 alerts, indicating good coverage.
   • CThe alert is generating too many alerts, and the team will ignore them until the backup system is fixed.
   • DThe alert has a 90% false positive rate, and the team is tuning the alert to exclude the backup system while maintaining detection coverage.
   Reveal Solution Discussion Select an answer first