Alert Triaging and Analysis CSA Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A SOC analyst is reviewing an alert for 'Potential ransomware activity' on a file server. The alert was triggered by a high number of file encryption events in a short period. The analyst checks the file server's logs and sees that a legitimate backup process is running and is encrypting files as part of its normal operation. The backup process is scheduled to run at this time. What should the analyst do?

   • AClose the alert as a false positive because the encryption is part of a scheduled backup process.
   • BQuarantine the file server because the encryption events could be ransomware.
   • CDisable the backup process to stop the encryption and then close the alert.
   • DEscalate the alert because the file encryption events match ransomware behavior.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst triages an alert for a single PowerShell execution that downloaded a file from a public file-sharing site. The file hash is unknown, and the user is a standard employee. The analyst has no other context. What is the most appropriate action?

   • AClose the alert as a false positive because the site is public.
   • BEnrich the alert with file reputation and user behavior data.
   • CBlock the file-sharing site for the entire organization.
   • DEscalate to incident response immediately.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC analyst is reviewing an alert for 'Suspicious login from a new device' on a user account that has access to financial systems. The login occurred from a device that is not enrolled in the company's device management system. The analyst checks the user's recent activity and sees that the user recently reset their password after a phishing attempt. The user is in the finance department and is currently working from home. What is the most appropriate action?

   • AEscalate the alert because the device is not enrolled and the user has access to financial systems.
   • BBlock the device and reset the user's password as a precaution, then close the alert.
   • CContact the user to verify the login and the device before deciding whether to escalate.
   • DClose the alert as a false positive because the user recently reset their password and is working from home.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary factor that determines whether an alert should be escalated to incident response?

   • AThe alert is confirmed as a true positive with potential impact on critical assets
   • BThe alert has been open for more than 24 hours
   • CThe alert was generated by a high-severity rule
   • DThe alert is the first one seen by the analyst that day
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of asset context that can be used to enrich an alert?

   • AThe current time zone of the analyst
   • BThe color of the alert icon
   • CThe name of the SIEM vendor
   • DThe operating system version of the affected host
   Reveal Solution Discussion Select an answer first