Incident Classification and Prioritization SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is handling a suspected data breach involving customer credit card information. The incident is classified as high severity and high impact. According to the escalation procedure, what should the analyst do?

   • AContain the incident by disconnecting the affected server from the network
   • BContact the incident response team lead and inform senior management
   • CContinue monitoring the incident and wait for more evidence
   • DNotify the public relations team and issue a press release
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which set of criteria is most commonly used to classify a security incident?

   • ASeverity, impact, and scope
   • BCost, time, and location
   • CColor, name, and date
   • DIP address, port, and protocol
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC analyst is handling an incident where a disgruntled employee is attempting to access a confidential HR database using another employee's credentials. The analyst has confirmed the unauthorized access attempts but has not yet determined if any data was viewed. The company's escalation policy states that incidents involving potential data breaches must be escalated within 30 minutes. The analyst has been working on the incident for 20 minutes and has not yet confirmed data access. What should the analyst do?

   • AWait until the 30-minute mark to escalate, as the policy requires escalation within 30 minutes, not before.
   • BReclassify the incident as a low-priority unauthorized access because no data has been confirmed as viewed.
   • CContinue investigating alone until data access is confirmed, then escalate.
   • DEscalate now because the incident involves potential unauthorized access to sensitive data and meets the escalation criteria.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An incident is classified as 'high severity' because it affects a critical business application and could cause significant financial loss. Which classification criteria are being applied?

   • AScope and urgency
   • BSeverity and impact
   • CConfidentiality, integrity, and availability
   • DLikelihood and probability
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC analyst is classifying an incident where an employee's laptop was stolen from a coffee shop. The laptop contains encrypted company data and the employee's credentials were stored in a password manager on the laptop. The company's security policy requires that all laptops be encrypted, but the analyst discovers that the laptop's hard drive was not encrypted. What is the most appropriate classification?

   • AUnauthorized access, because the thief may attempt to access the laptop.
   • BLow severity, because the laptop is only one device and the data is encrypted.
   • CLoss of asset, because the laptop is missing and no data has been confirmed accessed.
   • DData breach, because the unencrypted laptop may expose sensitive company data.
   Reveal Solution Discussion Select an answer first