Incident Classification and Prioritization SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC receives three alerts simultaneously: (1) a server is running a cryptocurrency miner, (2) a user's account has been locked out after multiple failed login attempts, and (3) a web application is returning errors due to a SQL injection attempt. The company's primary business is an e-commerce platform that processes credit card payments. Which incident should be categorized as having the highest potential business impact?

   • AThe account lockout, because it may indicate a brute-force attack on user accounts.
   • BThe SQL injection attempt, because it targets the web application that handles credit card payments and could lead to a data breach.
   • CThe cryptocurrency miner, because it consumes computing resources and may indicate a deeper compromise.
   • DAll three have equal impact because they are all security incidents.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC uses a 5x5 risk matrix with likelihood and impact ratings. An incident is assessed as having a likelihood of 4 (likely) and an impact of 5 (severe). According to the matrix, what is the appropriate prioritization level?

   • AMedium priority, because the likelihood is not certain
   • BLow priority, because the incident has not been confirmed
   • CCritical priority, because the impact is severe
   • DHigh priority, because the risk score is 20 out of 25
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC receives three alerts simultaneously. Alert 1: A phishing email was delivered to a user in the HR department, but the user did not click the link. Alert 2: A brute-force attack is targeting the VPN gateway, and several accounts have been locked out. Alert 3: A workstation in the R&D department is beaconing to a known command-and-control server. The SOC has limited staff and must prioritize. Which incident should be handled first?

   • AHandle all three simultaneously, because they are all important
   • BThe C2 beaconing, because it indicates an active compromise and potential data exfiltration
   • CThe phishing email, because it was delivered to a user and could lead to credential theft
   • DThe brute-force attack, because the VPN gateway is a critical asset
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC analyst discovers that a database containing customer personal information has been accessed by an unauthorized external IP address. The database is used by the customer support team and contains sensitive data. The analyst has confirmed the breach but does not yet know the full extent of the data accessed. What is the most appropriate escalation action?

   • AWait until the full extent of the data access is known before escalating to avoid unnecessary alarm.
   • BReclassify the incident as a low-priority unauthorized access because the database is not part of the core financial system.
   • CEscalate to the incident response manager immediately because the incident involves a data breach with high potential impact.
   • DEscalate only to the database administrator to change the credentials, without involving the incident response team.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC has two incidents to prioritize: Incident A is a phishing email that was opened by one user in the marketing department, but no credentials were entered. Incident B is a brute-force attack against the VPN gateway that has succeeded for one administrative account. The VPN is used by all remote employees. Which incident should be prioritized higher?

   • ABoth should be prioritized equally because both involve potential security breaches.
   • BIncident A, because phishing is a common attack vector and could lead to credential theft.
   • CIncident A, because the marketing department is more likely to handle sensitive customer data.
   • DIncident B, because it involves unauthorized access to a critical asset (VPN) and affects the entire remote workforce.
   Reveal Solution Discussion Select an answer first