Incident Escalation and Ticketing Systems SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst is handling a malware incident on a user's laptop. The analyst has quarantined the file and is about to update the ticket. Which action best demonstrates the core function of a ticketing system in this situation?

   • ADelete the ticket after quarantine because the immediate threat is gone.
   • BSend the file hash to the user via email for their records.
   • CLog the quarantine action, the file hash, and the timestamp in the ticket.
   • DMark the ticket as resolved immediately after quarantine.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC team is evaluating a new ticketing system. The team wants to ensure that all incident-related communication and actions are recorded in the ticket to support audits and post-incident reviews. Which feature is most important to require in the new system?

   • AA customizable dashboard that shows the number of open tickets.
   • BAn immutable audit log that records all changes to the ticket, including who made the change and when.
   • CAn email integration that automatically creates tickets from emails.
   • DA mobile app that allows analysts to update tickets from their phones.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During a security incident, an L1 analyst discovers that the incident involves a new zero-day exploit affecting multiple business-critical systems. Which action best aligns with escalation trigger criteria?

   • AClose the ticket after applying a temporary workaround
   • BContinue monitoring the incident and document findings for the weekly report
   • CWait for the vendor to release a patch before taking any further action
   • DEscalate the incident to L2/L3 and management because it is high-impact and requires specialized expertise
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC analyst receives a phone call from a user reporting a potential security issue. The analyst is busy with another high-priority incident. What should the analyst do to ensure the issue is not lost?

   • ACreate a ticket immediately with the user's details and the reported issue, then assign a priority.
   • BIgnore the call because the analyst is busy with a higher-priority incident.
   • CAsk the user to send an email instead, so the analyst can create a ticket later.
   • DTell the user to call back later when the analyst is free.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst at a financial institution detects a single workstation beaconing to a known malware command-and-control domain. The analyst checks the endpoint and finds the malware, but the workstation belongs to the CEO's administrative assistant, who is currently traveling. The analyst has already isolated the host. Which action is most appropriate next?

   • AEscalate to L2 for deeper investigation and notify management due to the executive's assistant being involved.
   • BClose the ticket after isolation because the immediate threat is contained.
   • CEscalate to L3 immediately because any malware on an executive's machine is a critical incident.
   • DWait for the assistant to return to reimage the workstation.
   Reveal Solution Discussion Select an answer first