Alert Triaging and Analysis CSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which technique is commonly used to validate whether an alert is a true positive?

   • AWaiting for the alert to appear multiple times before investigating
   • BChecking the alert against known indicators of compromise (IOCs)
   • CDeleting the alert from the SIEM to reduce noise
   • DIgnoring the alert if it comes from a low-priority asset
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst sees an alert for a domain admin account that failed 12 times in 3 minutes, then succeeded. The source IP is a known internal jump host. The analyst checks the user's recent activity and finds the user was on leave. The jump host logs show an automated password-rotation script ran at that time. What should the analyst do?

   • AEscalate to incident response because the account succeeded after failures.
   • BBlock the jump host IP and re-run the alert query.
   • CClose the alert as a false positive and document the script as the cause.
   • DDisable the account and force a password reset as a precaution.
   Reveal Solution Discussion Select an answer first
4. 33expert · medium

   A SOC analyst is triaging an alert for 'Potential data exfiltration' on a server that hosts sensitive customer data. The alert indicates that a large amount of data was transferred to an external IP. The analyst checks the server's logs and sees that the transfer was performed by a legitimate backup process that sends encrypted backups to a cloud storage provider. The external IP belongs to the cloud provider. What should the analyst do?

   • AClose the alert as a false positive because the transfer is part of a scheduled backup to a known cloud provider.
   • BEscalate the alert because the data transfer is large and involves sensitive data.
   • CQuarantine the server because the data transfer could be exfiltration.
   • DBlock the cloud provider's IP to prevent further data transfer.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Where does alert triage fit in the overall SOC incident detection and response workflow?

   • AAfter post-incident review and before reporting
   • BBefore detection, as part of proactive threat hunting
   • CAfter detection and before escalation or closure
   • DAfter incident containment and before eradication
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common criterion used to prioritize an alert during triage?

   • AThe potential impact on critical assets and the urgency of the threat
   • BThe name of the analyst who first viewed the alert
   • CThe number of characters in the alert description
   • DThe color of the alert icon in the SIEM console
   Reveal Solution Discussion Select an answer first