Alerting and Triaging Alerts SCE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During the triage process, after an analyst validates that an alert is a true positive, what is the next logical step?

   • ADelete the alert from the SIEM
   • BDetermine whether the alert requires escalation to a higher-level analyst or incident response team
   • CIgnore the alert because it is already validated
   • DClose the alert as a false positive
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which alert categorization describes a situation where malicious activity occurs but no alert is generated?

   • ATrue positive
   • BFalse positive
   • CFalse negative
   • DTrue negative
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the first step in the alert triage process?

   • AEscalation to the incident response team
   • BDocumentation of the final outcome
   • CInitial assessment of the alert to determine its validity and relevance
   • DEnrichment with threat intelligence
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC team has a recurring false positive alert that analysts have documented multiple times. The documentation shows the same root cause each time. The team wants to reduce the workload and improve the detection process. What is the best action based on the documentation?

   • AUse the documentation to tune the rule and eliminate the root cause of the false positive.
   • BCreate a new documentation entry each time the alert fires.
   • CEscalate the alert to incident response each time it fires.
   • DIgnore the alert because it is a known false positive.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC analyst is handling an alert that indicates a possible ransomware infection on a file server. The alert severity is 'medium' based on the rule, but the asset is a critical file server and the analyst has confirmed that files are being encrypted. What should the analyst do?

   • AClose the alert as a false positive because the severity is medium.
   • BEscalate the alert to incident response immediately despite the medium severity.
   • CWait for the severity to be upgraded by the system before escalating.
   • DReclassify the alert as a low priority and continue monitoring.
   Reveal Solution Discussion Select an answer first