Incident Classification and Prioritization SCE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary goal of the incident triage process?

   • ATo identify the root cause of the incident
   • BTo quickly assess and categorize incidents to determine the appropriate response
   • CTo restore systems to their normal state
   • DTo perform a full forensic analysis of the incident
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst is handling a ransomware incident that has encrypted files on a file server used by the entire engineering department. The analyst has isolated the server, but the incident is still ongoing because the ransomware may have spread to other servers. According to escalation procedures, what should the analyst do?

   • AEscalate the incident to the incident response manager because the impact is high and the scope may be expanding beyond the initial containment.
   • BContinue containment efforts alone and only escalate if the encryption spreads to the core network.
   • CReclassify the incident as a denial of service because the file server is unavailable to users.
   • DWait until the full scope of the infection is known before escalating to avoid false alarms.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst is handling a medium-severity incident involving a malware infection on a server that hosts a non-critical internal application. The analyst has isolated the server and is in the process of cleaning the infection. According to the escalation procedure, when should the analyst escalate this incident?

   • ANever, because the incident is medium severity
   • BImmediately, because any malware infection requires escalation
   • CAfter the infection is cleaned, to report the outcome
   • DIf the infection spreads to other systems or the impact increases
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is handling a low-severity incident involving a single workstation infected with adware. The analyst has contained the infection by disconnecting the workstation from the network. According to the escalation procedure, what should the analyst do?

   • ADocument the incident and continue with the standard remediation process
   • BNotify senior management because the workstation was disconnected
   • CContact the user's manager to inform them of the incident
   • DEscalate to the incident response team lead immediately
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A regional bank's SOC receives an alert that a single workstation in the marketing department has been sending outbound traffic to a known command-and-control IP address for the past 15 minutes. The workstation contains no sensitive data and is not used for administrative functions. The bank's core banking systems are unaffected. According to incident classification and prioritization best practices, what should the SOC analyst do first?

   • ACategorize the incident as a malware infection with low business impact and assign a medium priority, then proceed with triage and containment.
   • BImmediately isolate the workstation and declare a data breach because C2 traffic often indicates data exfiltration.
   • CClassify the incident as high severity because it involves malware and immediately escalate to the incident commander.
   • DIgnore the alert because the workstation is not part of the core banking system and the impact is minimal.
   Reveal Solution Discussion Select an answer first