A SOC manager is preparing to communicate a new critical alert to stakeholders. The alert detects a specific zero-day exploit that is actively being used in the wild. The SOC manager must decide how to communicate the alert to different audiences. Which communication strategy is most effective?

Wait until the alert fires before communicating anything.

Only inform the SOC team and keep the alert confidential from management.

Send the same detailed technical report to all stakeholders, including executives.

Provide a technical briefing to SOC analysts with full detection logic and triage steps, and a high-level executive summary to management highlighting business risk and response status.

A security operations team is building a new alert to detect multiple failed logins followed by a successful login on a domain controller. The detection engineer proposes a rule that triggers whenever the count of failed logins exceeds five within 10 minutes, regardless of the source or target account. The SOC manager reviews the rule and wants to reduce false positives while keeping the detection meaningful. Which adjustment should the SOC manager prioritize?

Remove the successful-login condition and alert on any five failed logins.

Increase the failed-login threshold to 20 within the same 10-minute window.

Set the severity to Critical so every occurrence is escalated immediately.

Add a condition that the successful login occurs from the same source IP as the failed attempts and target a privileged account.

An alert designed to detect 'pass-the-hash' activity is producing a high number of alerts from a legitimate administrative tool that uses similar authentication methods. The SOC manager wants to reduce false positives while maintaining detection of actual attacks. Which approach is most effective?

Change the alert to only trigger for domain admin accounts.

Create an exception list for the administrative tool's known endpoints and user accounts, and monitor for any changes to that tool's behavior.

Set the alert severity to Low so that analysts spend less time on it.

Increase the alert threshold to require multiple occurrences within a short time window.

A SOC analyst is creating an alert for the use of Mimikatz on a domain controller. The alert will fire when the process name matches and command-line arguments indicate credential dumping. The SOC manager must assign a severity level. Which severity assignment is most appropriate for this alert?

Medium, because the alert has not yet been validated in production.

Critical, because successful credential dumping on a domain controller can lead to full domain compromise.

High, because the alert may occasionally fire for legitimate administrative tooling.

Low, because the alert is only a detection and not a confirmed compromise.

A SOC analyst discovers an alert indicating that a domain administrator account was used to log in from an unfamiliar external IP address at 3:00 AM. The organization has no remote access policy that would explain this login. What severity level should the analyst assign to this alert?

High, because a privileged account accessed from an unknown external IP outside business hours indicates a likely compromise.

Low, because the login was successful and no malicious activity has been confirmed yet.

Critical, because any external login to a domain admin account is an active breach.

Medium, because it is a suspicious event but may have a benign explanation.

GIAC Security Operations Manager

Domain 2Objective 2

Managing Alert Creation and Processing GSOM Practice Questions (Page 8)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 36–40

36expert · hard
A SOC manager is preparing to communicate a new critical alert to stakeholders. The alert detects a specific zero-day exploit that is actively being used in the wild. The SOC manager must decide how to communicate the alert to different audiences. Which communication strategy is most effective?
Select an answer first
37application · medium
A security operations team is building a new alert to detect multiple failed logins followed by a successful login on a domain controller. The detection engineer proposes a rule that triggers whenever the count of failed logins exceeds five within 10 minutes, regardless of the source or target account. The SOC manager reviews the rule and wants to reduce false positives while keeping the detection meaningful. Which adjustment should the SOC manager prioritize?
Select an answer first
38application · medium
An alert designed to detect 'pass-the-hash' activity is producing a high number of alerts from a legitimate administrative tool that uses similar authentication methods. The SOC manager wants to reduce false positives while maintaining detection of actual attacks. Which approach is most effective?
Select an answer first
39application · medium
A SOC analyst is creating an alert for the use of Mimikatz on a domain controller. The alert will fire when the process name matches and command-line arguments indicate credential dumping. The SOC manager must assign a severity level. Which severity assignment is most appropriate for this alert?
Select an answer first
40application · medium
A SOC analyst discovers an alert indicating that a domain administrator account was used to log in from an unfamiliar external IP address at 3:00 AM. The organization has no remote access policy that would explain this login. What severity level should the analyst assign to this alert?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.