Alert Triaging and Analysis CSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC sees 100 alerts for outbound connections to a single IP address from 50 different workstations. The IP is a known file-sharing service. The alerts are all identical in nature. The analyst has limited time. What is the most efficient and effective approach?

   • AInvestigate a sample of the alerts to determine if the traffic is benign.
   • BEscalate all 100 alerts as a single incident.
   • CClose all alerts as false positives because the IP is a known service.
   • DBlock the IP address for all workstations.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A junior analyst is overwhelmed by the number of alerts and asks a senior analyst for advice on how to manage the workload. What is the most effective advice the senior analyst can give?

   • AInvestigate every alert thoroughly to avoid missing anything.
   • BEscalate all alerts to the incident response team.
   • CFocus on high-severity alerts and close low-severity alerts quickly.
   • DUse a structured triage process to categorize, prioritize, and enrich alerts.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A new SOC analyst asks why the team spends time triaging alerts instead of immediately responding to every one. What is the primary reason for the triage process?

   • ATo ensure every alert is investigated thoroughly.
   • BTo document all alerts for compliance purposes.
   • CTo filter out noise and prioritize the most critical alerts.
   • DTo automate the incident response process.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An alert fires for 'Suspicious outbound connection' from a server that hosts a legacy application. The destination IP is in a country where the company has no operations. The analyst checks the server's documentation and finds that the legacy application is supposed to connect to a vendor service for license validation, but the vendor's IP range is different from the destination. What should the analyst do?

   • ABlock the destination IP in the firewall to prevent potential data exfiltration.
   • BClose the alert as a false positive because the server is expected to make outbound connections.
   • CEscalate the alert because the destination IP is not the expected vendor IP, indicating a potential compromise or misconfiguration.
   • DUpdate the documentation to include the new IP address and close the alert.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important to document the rationale for closing an alert as a false positive?

   • ATo provide a record for future reference and improve detection rules
   • BTo increase the number of closed alerts in the metrics report
   • CTo satisfy the requirement of the SIEM vendor
   • DTo avoid having to investigate the alert again
   Reveal Solution Discussion Select an answer first