Alerting and Triaging Alerts SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is user behavior considered useful contextual information when triaging an alert?

   • AIt provides the user's password history for credential validation.
   • BIt replaces the need for threat intelligence in the triage process.
   • CIt helps determine whether the activity is unusual for that user, which can indicate compromise.
   • DIt automatically resets the user's account to prevent further access.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of enriching an alert with contextual information?

   • ADeleting the alert from the queue
   • BChanging the alert severity from medium to high
   • CAssigning the alert to a junior analyst
   • DAdding the asset criticality of the affected system to the alert
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC team notices that a specific SIEM rule generates hundreds of alerts daily for 'outbound DNS queries to known malicious domains' from a web proxy. Investigation shows the proxy performs DNS lookups for every URL it filters, and the domains are on a blocklist that the proxy already blocks. The alerts are all false positives. What is the most effective way to reduce this noise?

   • ADisable the rule entirely to stop the alerts.
   • BIncrease the severity of the rule so analysts notice it more.
   • CTune the rule to exclude traffic from the web proxy or correlate with proxy block events.
   • DCreate a suppression list of all known malicious domains.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After escalating a confirmed security incident to the incident response team, what should the SOC analyst document?

   • AThe names of all users who might be affected.
   • BThe cost of the incident in monetary terms.
   • COnly the alert ID and the time of escalation.
   • DThe triage steps taken, evidence gathered, and rationale for escalation.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is configuring a SIEM to detect lateral movement. They have two rules: Rule A triggers on any new admin account creation, and Rule B triggers on any remote PowerShell execution. The team wants to reduce false positives while still detecting lateral movement. What is the best approach?

   • AUse Rule A alone because admin account creation is a strong indicator of lateral movement.
   • BCreate a correlation rule that triggers only when both Rule A and Rule B fire within a short time window.
   • CDisable both rules and rely on manual monitoring.
   • DUse Rule B alone because remote PowerShell is a common lateral movement technique.
   Reveal Solution Discussion Select an answer first