Incident Classification and Prioritization SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which factor is most directly considered when prioritizing an incident that affects a system critical to the organization's core business operations?

   • ANumber of users in the organization
   • BTime of day the incident occurred
   • CCriticality of affected assets
   • DColor of the alert
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC analyst is triaging an alert that shows a user's workstation has been sending large amounts of data to an external cloud storage service during non-business hours. The user is a senior developer with access to source code repositories. The analyst has not yet confirmed whether the data transfer is legitimate. The company's data loss prevention (DLP) policy flags large outbound transfers as suspicious. What is the most appropriate triage decision?

   • AClassify the incident as a data breach and escalate immediately because the developer has access to sensitive source code.
   • BTreat the incident as a potential data exfiltration with high priority, and initiate a focused investigation to verify the nature of the transfer.
   • CDismiss the alert as a false positive because developers often use cloud storage for legitimate purposes.
   • DAssign a low priority because the user is a trusted employee and the transfer may be legitimate.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An organization uses a risk matrix with four priority levels: low, medium, high, and critical. The matrix is based on likelihood and impact, with scores from 1 to 5. Incident A has a likelihood of 5 and an impact of 3. Incident B has a likelihood of 3 and an impact of 5. Which incident should be prioritized higher?

   • ABoth incidents have the same priority, because the risk scores are equal
   • BIncident A, because the likelihood is higher
   • CIncident B, because the impact is higher
   • DIncident A, because high likelihood incidents are always prioritized first
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC analyst is triaging an alert that indicates a user's workstation has been infected with ransomware, but the ransomware has not yet encrypted any files. The user is a temporary contractor who only has access to a shared project folder. The analyst has isolated the workstation. What is the most appropriate triage action?

   • AClassify the incident as high severity because ransomware is a critical threat, and escalate immediately.
   • BEscalate to the incident response team because any ransomware infection is a critical incident.
   • CMark the incident as a false positive because the ransomware has not encrypted any files.
   • DCategorize the incident as a malware infection with medium severity, and continue monitoring for any encryption activity.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC uses a prioritization framework that assigns scores based on asset criticality (1-5), impact (1-5), and urgency (1-5), with a total score of 15. Incident A has an asset criticality of 5, impact of 4, and urgency of 2. Incident B has an asset criticality of 3, impact of 5, and urgency of 4. The SOC has resources to handle only one incident at a time. Which incident should be handled first?

   • AIncident A, because the asset is more critical and should always take precedence.
   • BIncident A, because it involves a critical asset with a high criticality score.
   • CBoth incidents should be handled simultaneously because they have similar scores.
   • DIncident B, because it has a higher total score (12 vs. 11) and a higher urgency score.
   Reveal Solution Discussion Select an answer first