Alert Triaging and Analysis CSA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When aggregating duplicate alerts, what is the main goal?

   • ATo increase the signal-to-noise ratio for analysts
   • BTo ensure every alert is investigated individually
   • CTo make the SIEM dashboard look more active
   • DTo increase the storage requirements of the SIEM
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is reviewing an alert that fired when a finance workstation attempted to connect to a known malicious IP address. The alert is rated 'high' by the SIEM. The analyst checks the asset inventory and sees the workstation belongs to the CFO, who is currently traveling. The analyst also queries the threat intelligence platform and finds the IP is associated with a phishing campaign targeting executives. However, the connection was blocked by the firewall and no data was exfiltrated. What should the analyst do next?

   • AWait for additional alerts before taking any action, since a single blocked connection is not enough to confirm malicious activity.
   • BEscalate the alert to the incident response team because the target is a high-value executive and the IP is tied to an active phishing campaign.
   • CClose the alert as a false positive because the firewall blocked the connection and no data was exfiltrated.
   • DLower the severity to 'low' and continue monitoring because the firewall successfully prevented the attack.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In a SOC workflow, what is the primary purpose of alert triage?

   • ATo replace the need for incident response by handling all alerts directly
   • BTo quickly assess each alert and decide whether it requires further investigation or can be dismissed
   • CTo permanently close all alerts that do not match a known signature
   • DTo automatically remediate all confirmed threats without human intervention
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC receives three alerts: (1) a single failed login for a standard user, (2) a successful login from a foreign IP for a service account with MFA disabled, and (3) a malware signature hit on an isolated test VM. The analyst has limited time. Which alert should be handled first?

   • AThe successful login from a foreign IP for the service account.
   • BThe malware signature hit on the isolated test VM.
   • CAll three at the same time.
   • DThe failed login for the standard user.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of documenting triage findings in a structured format?

   • ATo support incident tracking and post-incident review
   • BTo increase the workload of SOC analysts
   • CTo satisfy the requirements of the SIEM vendor
   • DTo replace the need for incident response
   Reveal Solution Discussion Select an answer first