Incident Classification and Prioritization SCE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC receives an alert about a DDoS attack targeting the company's public web server. The attack is causing intermittent availability issues. The web server is not business-critical, but it is customer-facing. How should this incident be classified?

   • ADenial of service, medium severity, because the impact is limited to availability
   • BData breach, high severity, because customer-facing services are involved
   • CUnauthorized access, high severity, because the server is exposed to the internet
   • DMalware, low severity, because the attack is external
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC uses a risk matrix with two dimensions: likelihood (low, medium, high) and impact (low, medium, high). The SOC has two incidents: Incident A is a malware infection on a single non-critical workstation, with a likelihood of further spread assessed as medium and impact of low. Incident B is a phishing email that was opened by a user in finance, but no credentials were entered; likelihood of credential compromise is low, but impact is high. The SOC has limited resources and can only fully investigate one incident at a time. Which incident should be investigated first?

   • AInvestigate Incident A first because malware is a more serious category than phishing.
   • BIncident A, because the malware is actively running and could spread to other systems.
   • CIncident B, because the impact is high even though the likelihood is low, and the finance department handles sensitive data.
   • DInvestigate both simultaneously because they are both security incidents.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   During triage, a SOC analyst receives an alert about a user account that has been used to log in from two different countries within a short time period. The user is a remote employee who frequently travels. What should the analyst do first?

   • ADisable the account immediately to prevent unauthorized access
   • BClassify the incident as a data breach and escalate to the incident response team
   • CIgnore the alert because the user is a frequent traveler
   • DContact the user to verify if the logins were legitimate
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which tool is commonly used to rank incidents by combining the likelihood of occurrence with the severity of impact?

   • AFlowchart
   • BRisk matrix
   • CGantt chart
   • DPareto chart
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst is classifying an incident where a web server is experiencing a distributed denial of service (DDoS) attack, causing the company's public website to be intermittently unavailable. The website is the primary sales channel for the company. Which classification criteria should the analyst use to determine the severity?

   • AThe business impact, the criticality of the affected asset, and the scope of the outage.
   • BThe duration of the attack and the number of affected users.
   • CThe number of packets per second the attack is generating.
   • DThe source IP addresses of the attack traffic.
   Reveal Solution Discussion Select an answer first