Alert Triaging and Analysis CSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of enriching an alert with threat intelligence during triage?

   • ATo increase the volume of alerts in the SIEM
   • BTo replace the need for manual analysis
   • CTo add context about the threat actor, indicators, and potential impact
   • DTo automatically block all related IP addresses
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC has a rule that flags any login from a new geographic location. An analyst sees an alert for a C-level executive logging in from a country where the company has no offices. The executive is currently in a meeting in the headquarters building. The analyst has access to the executive's calendar and confirms the meeting. What should the analyst do?

   • AContact the executive to verify the login.
   • BClose the alert as a false positive due to the meeting.
   • CEscalate the alert as a likely account compromise.
   • DBlock the login and reset the executive's password.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC analyst is investigating an alert for 'Suspicious outbound connection' from a workstation. The destination IP is a known malicious IP according to threat intelligence. The analyst checks the workstation's process list and sees that a legitimate application is making the connection. The application is a web browser that is open to a website that is not on any blocklist. The analyst also checks the DNS logs and sees that the workstation resolved a domain that is associated with the malicious IP. What should the analyst do?

   • ABlock the malicious IP in the firewall and close the alert.
   • BWait for additional alerts before acting because the connection might be a false positive.
   • CEscalate the alert because the destination is a known malicious IP, indicating a potential compromise.
   • DClose the alert as a false positive because the connection is from a legitimate application.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst sees an alert for 'Abnormal PowerShell usage' on a developer workstation. The analyst checks the process tree and sees that PowerShell was launched by the user's IDE during a build process. The script is a known build script that has been used for months. The alert is triggered because the script uses the Invoke-WebRequest cmdlet to download dependencies. What should the analyst do?

   • AEscalate the alert because PowerShell is a common attack vector and the script downloads external content.
   • BMark the alert as a false positive because the activity is expected behavior for the developer's build process.
   • CQuarantine the workstation because the use of Invoke-WebRequest is suspicious.
   • DModify the detection rule to block all PowerShell downloads.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is reviewing a dashboard that shows 50 low-severity alerts from the same subnet over the past hour. The alerts are for 'DNS query to suspicious domain' and each involves a different workstation. The analyst notices that all the workstations are in the marketing department and the domains are all recently registered. What should the analyst do first?

   • AInvestigate the alerts individually to determine if each workstation is compromised.
   • BEscalate the entire set of alerts to incident response immediately because of the volume.
   • CDisable the detection rule because the alerts are likely false positives from marketing activities.
   • DCorrelate the alerts to see if they share a common source, such as a malicious email campaign or a compromised update server.
   Reveal Solution Discussion Select an answer first