Alerting and Triaging Alerts SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SOC analyst is triaging two alerts. Alert 1 is a low-severity alert on a domain controller (critical asset). Alert 2 is a high-severity alert on a non-critical web server. Both alerts are unvalidated. The analyst has time to fully investigate only one alert before the end of the shift. Which alert should the analyst prioritize?

   • AAlert 2, because web servers are more exposed to the internet.
   • BAlert 2, because high severity always takes precedence.
   • CAlert 1, because the domain controller is a critical asset and the potential impact is higher.
   • DAlert 1, only if it is a true positive.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does correlation help reduce false positives in alert management?

   • ABy increasing the severity of all alerts
   • BBy sending alerts to multiple analysts for review
   • CBy requiring multiple related events to occur before an alert is triggered
   • DBy automatically deleting all alerts that are not correlated
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is accurate documentation of triage actions important in a SOC?

   • AIt increases the severity of alerts
   • BIt replaces the need for escalation procedures
   • CIt supports audit trails and continuous improvement of detection and response processes
   • DIt automatically resolves alerts
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC analyst is triaging an alert that indicates a possible lateral movement from a compromised workstation to a file server. The alert is medium severity and the file server is not critical. However, the analyst notices that the source workstation belongs to a high-privilege user. The analyst has limited time and must decide whether to escalate or continue investigating. What should the analyst do?

   • AClose the alert as a false positive because the file server is not critical.
   • BEscalate only if the file server contains sensitive data.
   • CEscalate immediately because the source user is high-privilege, even though the file server is not critical.
   • DContinue investigating for 30 minutes to gather more evidence before deciding.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   In a SOC, an alert is marked as 'high severity' but 'low priority.' What does this combination typically indicate?

   • AThe alert is a false positive that requires no action.
   • BThe alert has been automatically resolved by the SIEM.
   • CThe alert is urgent and must be escalated immediately.
   • DThe alert describes a potentially damaging event, but it affects a low-value asset and can be handled later.
   Reveal Solution Discussion Select an answer first