Incident Classification and Prioritization SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During initial triage, a SOC analyst sees an alert for a single workstation that has been beaconing to an external IP every 5 minutes. The workstation belongs to an executive who handles mergers and acquisitions. The analyst has not yet confirmed whether any data was exfiltrated. What is the most appropriate triage action?

   • AAssign a low priority because only one workstation is affected and the scope is limited.
   • BMark the incident as a false positive because beaconing is often benign and the alert lacks confirmed data loss.
   • CClassify the incident as high severity due to the criticality of the affected asset and the potential for sensitive data exposure, then escalate for immediate investigation.
   • DCategorize the incident as a data breach because the executive's workstation likely contains sensitive information.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst is performing triage on an alert that indicates a user's workstation is communicating with a known malicious domain. The user is on the IT team and has local administrator rights. The analyst has not yet verified whether any malicious files were downloaded. What should the analyst do as part of the triage process?

   • AGather additional context, such as the domain reputation, the process initiating the connection, and any related alerts, before classifying the incident.
   • BCategorize the incident as unauthorized access because the workstation may be under attacker control.
   • CMark the incident as a false positive because the user is an IT administrator and may have visited the domain for testing purposes.
   • DImmediately escalate to the incident response team because the user is an IT administrator and the risk is high.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC is handling a high-severity incident involving a ransomware infection on a domain controller. The incident response team lead is on vacation and unavailable. The SOC manager is available. According to the escalation procedure, who should the analyst escalate to?

   • AThe SOC manager, as the next available escalation point
   • BThe system administrator, because the domain controller is affected
   • CThe incident response team lead, even though they are on vacation
   • DThe chief information security officer (CISO) directly
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst discovers that an attacker has successfully logged into a user's account without authorization. Which incident category does this fall under?

   • AUnauthorized access
   • BDenial of service
   • CData breach
   • DMalware
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC receives an alert about a user accessing a known malicious website. The user's workstation is used for general office work and does not contain sensitive data. The access was blocked by the web proxy. How should this incident be classified?

   • ALow severity, because the access was blocked and no data is at risk
   • BData breach, high severity, because the user visited a malicious site
   • CUnauthorized access, medium severity, because the user bypassed the proxy
   • DMalware, high severity, because the user accessed a malicious site
   Reveal Solution Discussion Select an answer first