Managing Alert Creation and Processing GSOM Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC team is deploying a new alert for 'data exfiltration via cloud storage'. The alert is expected to generate a moderate number of false positives due to legitimate business use of cloud storage. The SOC manager must communicate the alert's rollout to both the security team and business stakeholders. What is the best communication strategy?

   • AWait until the alert is fully tuned and has no false positives before communicating to anyone.
   • BProvide the security team with a detailed runbook and inform business stakeholders of the alert's purpose and the potential for false positives, with a plan for tuning.
   • CInform business stakeholders first and provide the security team with only a brief summary.
   • DOnly inform the security team and keep the alert confidential to avoid alarming business stakeholders.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During a shift handover, an analyst notes that an alert has been open for several hours with no investigation notes. The alert is for a potential data exfiltration from a database server. The incoming analyst has limited context about the alert. What should the incoming analyst do first?

   • AContact the previous analyst to ask what they found, even if they are off duty.
   • BReview the raw alert data and any associated logs to understand the event, then document findings in the alert ticket.
   • CEscalate the alert to the incident response team immediately without further analysis.
   • DClose the alert as a false positive because no notes exist, assuming the previous analyst found nothing.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A SOC analyst is triaging an alert that indicates a user downloaded a file from a phishing email and executed it. The endpoint protection tool has quarantined the file, and no other systems are affected. What severity should the analyst assign?

   • ACritical, because the user executed malware.
   • BMedium, because the user clicked and executed a malicious file, but the impact is contained.
   • CHigh, because any execution of a malicious file is a serious incident.
   • DLow, because the file was quarantined and no other systems are affected.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A SOC team has created a new alert for detecting unauthorized changes to critical firewall rules. The alert has been tested and is ready for production. According to best practices, what should the team do before enabling the alert?

   • AInform the firewall team that they will receive alerts and should investigate them.
   • BCreate a test firewall rule change to verify the alert fires in production.
   • CPublish a runbook that includes the alert's trigger conditions, expected false positives, and investigation steps.
   • DAdd the alert to the SIEM with a high severity so that it appears at the top of the queue.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary purpose of validating an alert rule with historical data before deployment?

   • ATo ensure the rule triggers on known attack patterns and minimizes false positives
   • BTo determine the cost of the SIEM license
   • CTo assign the alert to a specific analyst
   • DTo document the alert in the change management system
   Reveal Solution Discussion Select an answer first