Managing Alert Creation and Processing GSOM Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC manager is reviewing an alert that detects 'multiple failed logins followed by a successful login' for all user accounts. The alert currently has a threshold of 5 failed attempts within 10 minutes. The alert produces 200 alerts per day, and the SOC team is overwhelmed. Analysis shows that 90% of the alerts are for standard users who eventually log in successfully after a few typos. The remaining 10% involve privileged accounts. The SOC manager wants to reduce the volume while preserving detection of privileged-account compromise. Which approach best balances the trade-off?

   • ADisable the alert for standard users entirely.
   • BIncrease the threshold to 15 failed attempts for all accounts.
   • CKeep the current rule but change the severity to Low for all alerts.
   • DCreate two separate rules: one for privileged accounts with the current threshold, and one for standard users with a higher threshold (e.g., 15 failed attempts).
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations team is implementing a new alert for suspicious PowerShell usage. The detection engineering lead has drafted a query that matches any PowerShell process execution with encoded command arguments. Before deploying this alert to production, the team wants to ensure it will not overwhelm the analysts with noise. Which step should the team take first?

   • ADeploy the alert in a test environment and run it against historical data to measure the expected alert volume and false positive rate.
   • BDocument the alert in the runbook and notify all analysts of the new alert via email.
   • CSet the alert severity to Critical so that any occurrence is immediately escalated to senior analysts.
   • DImmediately enable the alert in production to start collecting data on its behavior.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A SOC manager is reviewing alert severity assignments. Currently, all alerts are set to High severity, causing analysts to treat them equally and potentially miss critical incidents. The manager wants to implement a more effective severity model. Which approach is the best trade-off?

   • ADefine severity based on the potential impact and urgency of the underlying threat, and involve analysts in the calibration process.
   • BSet all alerts to Low severity to reduce pressure on analysts.
   • CUse a fixed severity based on the asset value of the affected system, regardless of the threat type.
   • DLet each analyst assign severity based on their personal judgment without guidelines.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An alert for 'multiple failed logins followed by a successful login' is generating hundreds of alerts per day, most of which are caused by a legacy application that retries authentication with a service account. The SOC manager wants to reduce the noise without losing detection of actual brute-force attacks. Which action is most appropriate?

   • AKeep the alert as is and instruct analysts to ignore alerts from that service account.
   • BAdd an exclusion for the specific service account and adjust the threshold to require a higher number of failures before a successful login.
   • CDisable the alert entirely to stop the noise.
   • DIncrease the severity of the alert to Critical so that analysts pay more attention to each alert.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC is implementing a new alert for a critical vulnerability exploitation attempt. The alert will be monitored 24/7. The SOC manager needs to communicate the alert's purpose and response expectations to the on-call team. Which communication is most effective?

   • AWait until the alert fires to explain how to handle it.
   • BSend a one-line message in the team chat that a new alert has been added.
   • CPublish a detailed alert documentation page that includes the trigger logic, severity, triage steps, and escalation path, and announce it in the team meeting.
   • DVerbally explain the alert to the day-shift analysts only.
   Reveal Solution Discussion Select an answer first