Alerting and Triaging Alerts SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SIEM rule detects a single outbound connection to a known command-and-control (C2) IP address from a workstation. The analyst investigates and finds that the workstation's DNS cache contains the C2 domain, and a process on the workstation is actively communicating with the IP. No other hosts are affected. How should the analyst classify this alert?

   • ATrue positive, because the activity matches the rule and is confirmed malicious.
   • BFalse positive, because only one connection was observed.
   • CTrue negative, because the alert did not trigger on other hosts.
   • DFalse negative, because the rule missed other C2 traffic.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is triaging an alert about a potential data exfiltration from a finance server. The analyst has confirmed that the activity is malicious and that the server contains sensitive customer data. The incident is ongoing. According to the triage process, what should the analyst do next?

   • APerform a full forensic analysis before escalating to ensure all evidence is collected.
   • BEscalate the alert to the incident response team immediately.
   • CClose the alert and document it as a false positive after initial assessment.
   • DWait for additional alerts before taking any action to avoid false alarms.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst reviews an alert generated by an IDS rule that flags any outbound connection to a known malicious IP. The analyst investigates and finds that the connection was made by a legitimate internal service that uses a public IP that was previously flagged but is now owned by a benign cloud provider. How should this alert be classified?

   • AFalse positive, because the activity is benign despite the rule matching.
   • BTrue negative, because the connection is legitimate and no alert should have fired.
   • CFalse negative, because the rule failed to identify the service as benign.
   • DTrue positive, because the rule matched the exact IP address.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst receives an alert for a single failed login to a domain admin account from a known internal IP. The alert is rated 'high severity' by the SIEM because the account is privileged. The analyst checks the user's recent activity and finds the user successfully logged in 30 seconds later from the same workstation. The failed attempt appears to be a typo in the password. What should the analyst do first?

   • APerform initial assessment and validation, then document the finding and close as a false positive if no other suspicious activity is present.
   • BMark the alert as a false positive and close it without further action.
   • CChange the severity to low and leave the alert open for 24 hours for monitoring.
   • DEscalate the alert to the incident response team immediately because the account is privileged.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SIEM rule generates many alerts for 'admin login outside business hours' from a specific user. Investigation shows the user is a system administrator who regularly performs maintenance at night. The alerts are all false positives. What is the best way to reduce these false positives while maintaining detection for other users?

   • ADisable the rule to stop all alerts.
   • BChange the rule to alert only on weekends.
   • CIncrease the severity of the rule to make it more visible.
   • DCreate an exception in the rule for this specific user's account.
   Reveal Solution Discussion Select an answer first