Alert Triaging and Analysis CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An alert fires for 'Suspicious PowerShell execution' on a server that hosts a critical database. The analyst checks the process command line and sees a script that downloads a file from a public file-sharing site. The server's change-management system shows no approved maintenance for this server today. The file-sharing domain is not on any threat-intel blocklist. What should the analyst do?

   • ATreat the alert as a true positive because the activity is unapproved and involves downloading an executable from an external site.
   • BClose the alert as a false positive because the domain is not on a threat-intel blocklist.
   • CEscalate to incident response only if the downloaded file is confirmed malicious by antivirus.
   • DWait for additional alerts before taking action because the download might be a legitimate admin task.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After triaging an alert, an analyst determines it is a true positive and escalates it. What is the most important information to include in the escalation documentation?

   • AThe full raw log data for the alert.
   • BThe alert ID, the analyst's name, and the time of triage.
   • CThe triage findings, evidence, and rationale for escalation.
   • DA recommendation to close the alert if it is not critical.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst is investigating a series of alerts: a phishing email reported by a user, a subsequent login from a new device, and then a download of a suspicious file. The analyst notices that the login and download occurred within minutes of the user clicking the phishing link. What is the most appropriate action?

   • ACorrelate the alerts into a single incident because they form a clear attack chain from phishing to potential compromise.
   • BClose the alerts as false positives because the user reported the phishing email.
   • CEscalate the alerts to incident response immediately without further analysis.
   • DTreat the alerts as separate incidents and investigate each one independently.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary benefit of correlating multiple related alerts during triage?

   • AIt reduces the number of alerts by combining them into a single incident
   • BIt increases the severity of every alert automatically
   • CIt deletes all duplicate alerts from the SIEM permanently
   • DIt ensures that all alerts are escalated to incident response
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An alert fires for a user accessing a known phishing URL. The analyst checks the user's activity and finds the user clicked the link in a test email sent by the security team. What is the correct classification and action?

   • ATrue positive; escalate to incident response.
   • BTrue positive; block the user's access.
   • CFalse positive; close the alert.
   • DBenign anomaly; close the alert with documentation.
   Reveal Solution Discussion Select an answer first