Alerting and Triaging Alerts SCE Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A SOC analyst triages an alert and determines it is a false positive. The analyst closes the alert but does not record the reason or the investigation steps. Later, the same alert pattern repeats, and another analyst spends time investigating it again. What is the primary problem with the analyst's action?

   • AThe alert was closed without escalation to a senior analyst.
   • BThe analyst should have changed the rule to prevent future alerts.
   • CThe analyst did not document the triage actions and findings, preventing knowledge reuse and continuous improvement.
   • DThe analyst should have marked the alert as a true positive to avoid future investigation.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An alert fires for 'unusual outbound traffic' from a server that hosts a public API. The alert is based on a baseline of normal traffic. The analyst checks threat intelligence and finds the destination IP is a known cloud provider. The server's logs show the traffic is from an API client that recently increased its usage. The analyst also notes that the server is not critical. What is the most appropriate classification?

   • AFalse negative, because the rule missed other malicious traffic.
   • BTrue positive, because the traffic exceeds the baseline.
   • CTrue negative, because the alert did not fire on other servers.
   • DFalse positive, because the destination is a legitimate cloud provider and the traffic is consistent with a known client's behavior.
   Reveal Solution Discussion Select an answer first