Alert Triaging and Analysis CSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How are alerts typically categorized during triage?

   • ABy the IP address of the source and destination only
   • BBy the number of times the alert has been seen before
   • CBy the time of day the alert was generated
   • DBy the type of threat or activity and the severity level
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC analyst is triaging an alert for 'Lateral movement' that fired on a domain controller. The alert indicates that a user account was used to log into multiple workstations in a short period. The user is a system administrator who is on-call and has a history of remote administration. The analyst checks the user's recent activity and sees that the logins occurred from a VPN IP that is not in the usual VPN range. The user's account has not been locked out and there is no evidence of credential dumping. What is the most appropriate decision?

   • AClose the alert as a false positive because the user is a system administrator who commonly performs remote administration.
   • BBlock the VPN IP and reset the user's password as a precaution, then close the alert.
   • CContact the user to verify the VPN IP and the logins before deciding whether to escalate.
   • DEscalate the alert to incident response because the VPN IP is unusual and the activity matches lateral movement patterns.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A SOC analyst has just finished triaging an alert that was escalated to incident response. The incident response team confirmed a true positive and contained the threat. The analyst is now responsible for documenting the triage findings. What is the most important information to include in the documentation?

   • AThe full timeline of the alert, the triage decision, the rationale for escalation, and the actions taken by the incident response team.
   • BThe incident response team's actions, but not the triage rationale, since the incident was confirmed.
   • CThe alert details and the final outcome, but not the rationale for escalation, to keep the documentation concise.
   • DOnly the final outcome of the incident, since the triage details are no longer relevant.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC analyst is investigating an alert for 'Malicious macro in document' that was triggered by an email attachment. The document was opened by a user in the finance department. The analyst checks the sandbox report and sees that the macro attempts to download a payload from a URL that is currently not on any blocklist. The analyst also checks the user's machine and finds that the download was blocked by the endpoint protection. The user reports that the email was from a known vendor and they were expecting an invoice. What should the analyst do?

   • AClose the alert as a false positive because the download was blocked and the email was from a known vendor.
   • BEscalate the alert because the macro attempted to download a payload, indicating a likely true positive.
   • CVerify the email's authenticity by checking the sender's domain and contacting the vendor, then decide whether to escalate.
   • DQuarantine the user's machine immediately because the macro attempted to download a payload.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following should be included in the documentation of a triaged alert?

   • AThe personal opinions of the analyst about the alert
   • BThe actions taken and the outcome of the triage
   • CThe analyst's favorite threat intelligence source
   • DThe number of alerts closed by the analyst that day
   Reveal Solution Discussion Select an answer first