Managing Alert Creation and Processing GSOM Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which action is most likely to reduce false positives for an alert that triggers on multiple failed logins followed by a successful login?

   • AIncreasing the threshold for failed logins within the specified time window
   • BRemoving the successful login condition from the rule
   • CDisabling the alert entirely
   • DDecreasing the time window for counting failed logins
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst is triaging an alert for 'suspicious scheduled task creation'. The analyst determines that the scheduled task was created by a legitimate IT automation tool. The analyst wants to close the alert. What is the most appropriate closure action?

   • AClose the alert without any notes to save time.
   • BEscalate the alert to a senior analyst even though it is benign.
   • CClose the alert as a false positive and add a note explaining the legitimate tool, then recommend a rule tuning to exclude that tool.
   • DReopen the alert every time the IT tool runs.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An alert has been open for 30 days. The investigation has stalled because the analyst assigned to it left the company. The alert is for a possible insider threat involving data access. The SOC manager wants to resolve the alert. What is the best course of action?

   • AClose the alert as a false positive because the original analyst is no longer available.
   • BReassign the alert to a current analyst, review the existing investigation notes, and determine if additional data collection is needed.
   • CDelete the alert from the system to clean up the queue.
   • DEscalate the alert to management to decide whether to continue the investigation.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is creating an alert for 'unusual PowerShell execution'. The team has a limited budget for tuning and cannot afford extensive testing. They must balance the need for detection with the risk of false positives. Which approach is the best trade-off?

   • AStart with a conservative rule that targets specific high-confidence indicators, then expand coverage based on observed false positive rates.
   • BSkip testing and deploy the rule directly to production to save time and money.
   • CDeploy a broad rule that captures all PowerShell execution and rely on analysts to filter out false positives.
   • DSet the alert to Critical severity to ensure analysts investigate every alert.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An alert for 'possible ransomware behavior' triggers when a single file is renamed with a suspicious extension. The alert fires hundreds of times per day, and analysts are ignoring it. The SOC manager needs to reduce the noise while still detecting actual ransomware activity. Which change is most effective?

   • AIncrease the time window to 24 hours while keeping the single-file condition.
   • BModify the rule to require a minimum number of files (e.g., 10) with the suspicious extension within a short time window on the same host.
   • CDisable the alert and rely on endpoint protection to detect ransomware.
   • DKeep the rule as-is but change the severity to Low.
   Reveal Solution Discussion Select an answer first