Incident Classification and Prioritization SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC uses a 5x5 risk matrix that multiplies likelihood by impact to assign a priority score. An incident is detected where a phishing email bypassed the mail filter and was opened by one user in finance, but the user did not click any link or attachment. The SOC estimates the likelihood of further compromise as low and the potential business impact as high if the user had clicked. What priority should the SOC assign?

   • ACritical priority, because finance is a sensitive department and the email could have caused a data breach.
   • BLow priority, because no actual compromise occurred and the user did not click.
   • CMedium priority, because the likelihood is low but the potential impact is high, yielding a moderate risk score.
   • DHigh priority, because any phishing email that bypasses the filter is a critical incident.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During initial triage, a SOC analyst receives an alert about a user downloading a suspicious executable from a file-sharing site. The analyst checks the file's hash against a threat-intelligence feed and finds no known malicious signature. The user reports they downloaded the file for a work-related project. What should the analyst do next?

   • ARun the file in a sandbox to observe its behavior before deciding
   • BEscalate the alert to the incident response team immediately
   • CClose the alert as a false positive, because the hash is not known malicious
   • DQuarantine the file and block the file-sharing site for all users
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When should an incident be escalated to a higher-level response team?

   • AWhen the incident has been fully resolved
   • BWhen the incident is a false positive
   • CWhen the incident's severity exceeds the current team's authority or capability
   • DWhen the incident is low severity
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC uses a risk matrix with four levels: low, medium, high, and critical. An incident involves a malware infection on a single point-of-sale (POS) terminal in a retail store. The terminal processes credit card payments but does not store card data. The malware is known to be a keylogger. What is the most appropriate priority?

   • AHigh, because any malware on a POS terminal is a critical incident due to payment card data.
   • BLow, because only one terminal is affected and the store can continue operating with other terminals.
   • CCritical, because a keylogger on a POS terminal could lead to a massive data breach.
   • DMedium, because the affected asset is a POS terminal with potential for card data interception, but the scope is limited to one device.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During incident triage, an analyst receives multiple incident reports. What is the first action the analyst should take?

   • AAssess each incident's severity and impact
   • BBegin forensic analysis on the first incident
   • CClose all incidents as false positives
   • DImmediately escalate all incidents to management
   Reveal Solution Discussion Select an answer first