Alerting and Triaging Alerts SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SIEM alert fires for 'multiple failed logins' from a single source IP against a file server. The source IP is a known internal workstation used by a marketing employee. The file server hosts non-confidential marketing assets. The employee has a history of forgetting passwords. What should the analyst do to enrich this alert before deciding on escalation?

   • AIgnore the alert because the file server is not critical.
   • BImmediately escalate to incident response because multiple failed logins indicate a brute-force attack.
   • CCheck threat intelligence for the source IP and review the employee's recent authentication behavior.
   • DBlock the source IP at the firewall to prevent further attempts.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is triaging an alert that indicates a possible ransomware infection on a domain controller. The alert has high severity and high priority. The analyst has confirmed that multiple files are being encrypted with a known ransomware extension. According to escalation procedures, what should the analyst do?

   • AAttempt to contain the infection by isolating the domain controller from the network.
   • BWait for additional alerts to confirm the infection before escalating.
   • CEscalate to the incident response team immediately with all gathered evidence and context.
   • DDocument the alert and continue monitoring for further activity.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC analyst is triaging an alert for a potential data breach on a customer database. The alert is high severity but low priority because the database is in a test environment. The analyst finds that the database contains synthetic test data, not real customer data. However, the database is connected to a production network. What should the analyst do?

   • AIgnore the alert because the database is in a test environment.
   • BClose the alert as a false positive because the data is synthetic.
   • CEscalate to incident response because the database is connected to the production network.
   • DChange the priority to high and continue monitoring.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst receives an alert about a user accessing a sensitive file share outside business hours. The analyst checks the user's behavior and finds that the user has a history of working late. The file share is not classified as critical. What is the most appropriate triage action?

   • AEscalate the alert to incident response because it is outside business hours.
   • BMark the alert as low priority and continue monitoring, noting the user's normal behavior.
   • CClose the alert as a false positive because the user often works late.
   • DDisable the rule that generated the alert to avoid future noise.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is triaging an alert about a potential malware infection on a standard user's workstation. The alert is low severity and low priority. After initial assessment, the analyst finds the file is a known false positive. What should the analyst do?

   • AEscalate to incident response because any malware alert must be escalated.
   • BQuarantine the workstation to be safe.
   • CLeave the alert open and wait for more evidence.
   • DDocument the triage actions and close the alert as a false positive.
   Reveal Solution Discussion Select an answer first