A SOC analyst receives an alert about a single workstation exhibiting suspicious behavior. The alert is not affecting other systems and the workstation is not critical to business operations. According to common triage criteria, how should this incident be prioritized?

Critical priority, because the incident could escalate

High priority, because any suspicious behavior requires immediate containment

Low priority, because the impact is limited and the affected system is not critical

Medium priority, because the incident involves a workstation

EC-CouncilCertified SOC Analyst

Domain 6Objective 1

Incident Response Process CSA Practice Questions (Page 12)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

56questions here

12free pages

9concepts

Questions 56–56

56foundation · easy
A SOC analyst receives an alert about a single workstation exhibiting suspicious behavior. The alert is not affecting other systems and the workstation is not critical to business operations. According to common triage criteria, how should this incident be prioritized?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Incident Response Process CSA Practice Questions (Page 12)

Questions 56–56

A SOC analyst receives an alert about a single workstation exhibiting suspicious behavior. The alert is not affecting other systems and the workstation is not critical to business operations. According to common triage criteria, how should this incident be prioritized?

Keep studying — Incident Response, Forensics and Cloud SOC