Alerting and Triaging Alerts SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC team is required to provide a monthly report on alert triage effectiveness. The team wants to show how many alerts were true positives, false positives, and how many were escalated. What is the best way to ensure accurate reporting?

   • AEstimate the numbers based on the severity of the alerts.
   • BEnsure that every alert has a final classification and escalation status documented in the ticketing system.
   • COnly report on alerts that were escalated.
   • DUse the initial alert classification without review.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What should be recorded when documenting a triage action for an alert?

   • AThe analyst's name, the actions taken, and the rationale for the decision
   • BOnly the alert ID and the final status
   • CThe number of similar alerts in the past
   • DThe alert's severity and priority only
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   After escalating an alert to incident response, the analyst receives feedback that the escalation was unnecessary because the activity was benign. What should the analyst do to improve future triage?

   • AEscalate all future alerts to incident response to be safe.
   • BIgnore the feedback because the alert was escalated in good faith.
   • CDisable the rule that generated the alert to prevent future escalations.
   • DDocument the outcome and review the triage decision to identify what enrichment was missed.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best describes how alerts are generated in a typical SIEM environment?

   • AAlerts are generated by the firewall whenever it blocks a packet.
   • BAlerts are produced when log sources match correlation rules or signatures configured by the security team.
   • CAlerts are created only after a human analyst confirms an incident.
   • DAlerts are generated automatically by the operating system whenever any user logs in.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst is reviewing an alert that was generated by a rule designed to detect credential dumping. The analyst finds that the rule did not fire for a known credential dumping attack that occurred on the same network. How should the analyst classify the missed detection?

   • ATrue positive, because the attack was real.
   • BFalse negative, because the rule missed a real attack.
   • CFalse positive, because the rule did not fire.
   • DTrue negative, because no alert fired and no attack occurred.
   Reveal Solution Discussion Select an answer first