GIAC Security Operations Certified GSOC Prüfungsfragen mit Lösungen:
1. Which methods are commonly used to detect suspicious activity in event logs?
(Choose Two)
Response:
A) Automating log analysis using SIEM tools
B) Reviewing logs manually once a year
C) Ignoring all successful login attempts
D) Correlating logs from multiple sources to identify patterns
2. Which of the following tools is commonly used for network traffic analysis?
Response:
A) Nessus
B) Wireshark
C) Tripwire
D) Metasploit
3. Your SOC team is struggling to keep up with the large volume of alerts generated by your SIEM system. Many alerts are low-priority, and the team is overwhelmed, leading to delayed response times for critical incidents. You have been tasked with improving the efficiency of the SIEM.
Which of the following actions should you take to optimize SIEM performance and reduce alert fatigue?
(Choose Three)
Response:
A) Implement automation to handle low-severity alerts
B) Escalate all alerts, regardless of severity
C) Fine-tune SIEM rules to reduce false positives
D) Disable logging for non-critical systems
E) Correlate logs from multiple sources to identify and prioritize critical threats
4. Which protocol is vulnerable to man-in-the-middle (MitM) attacks due to the lack of encryption?
Response:
A) DNSSEC
B) SSH
C) HTTPS
D) FTP
5. Why is it critical to have an understanding of the layered architecture of enterprise networks when analyzing network traffic?
Response:
A) Knowledge of different layers helps in pinpointing the source and nature of network issues.
B) It is only necessary for designing network infrastructure, not for analysis.
C) It aids in understanding where bottlenecks can occur.
D) It is essential for legal compliance in many jurisdictions.
Fragen und Antworten:
| 1. Frage Antwort: A,D | 2. Frage Antwort: B | 3. Frage Antwort: A,C,E | 4. Frage Antwort: D | 5. Frage Antwort: A |
903 Kundenbewertungen
